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Flying  Qualities  Flight  Testing  of  Digital  Flight 

Control  Systems 

(RTO  AG-300  Vol.  21  /  SCI-034) 


Executive  Summary 

This  document  covers  a  wide  range  of  subjects  which  are  applicable  to  the  flying  qualities  flight  testing 
of  Digital  Flight  Control  Systems  (DFCS).  By  necessity,  the  technical  depth  and  disciplines  involved 
in  testing  such  systems  cover  a  wide  range  of  specialties.  The  job  of  flight  testing  a  DFCS  is  really  that 
of  a  systems  development  and  integration  problem.  The  DFCS  depends  on  many  other  aircraft 
characteristics,  systems,  and  subsystems  in  order  to  operate  properly  and  perform  its  intended  mission. 
Each  must  perform  adequately  in  order  for  the  entire  DFCS  to  properly  operate. 

This  report  covers  specific  areas  deemed  especially  important  by  the  author,  specifically  the  test 
preparation  and  data  analyses  sections.  Proper  preparation  and  data  analyses  are  cornerstones  of  any 
successful  flight  test  program,  and  as  such  have  been  given  broad  attention  in  this  report.  In  addition, 
the  consequences  of  potential  mistakes  while  testing  a  DFCS  can  be  disastrous,  leading  to  loss  of 
aircraft  or  life.  Since  this  type  of  flight  testing  is  often  hazardous,  it  is  incumbent  on  the  test  team  to 
carefully  plan  and  execute  the  program.  The  test  team  must  be  knowledgeable  about  what  the  aircraft  is 
predicted  to  do,  what  it  is  doing,  and  the  reasons  for  both.  Armed  with  this  knowledge,  the  DFCS  flight 
test  team  can  make  the  appropriate  decisions  required  during  the  execution  of  the  test  program. 
Without  minimizing  the  other  areas  involved,  the  author  believes  that  preparation  and  data  analyses  are 
the  two  most  important  aspects  of  testing  hence  the  emphasis  on  these  areas. 

Lastly,  the  procedures  and  practices  presented  in  this  report  are  a  compilation  of  best  practices  as 
learned  over  the  years  by  the  test  community.  They  certainly  are  neither  exhaustive  nor  all-inclusive, 
but  simply  a  list  of  perhaps  the  most  commonly  used  practices.  There  never  has  been,  nor  will  there 
ever  likely  be,  a  test  program  where  it  is  possible  or  practical  to  employ  all  of  the  practices  discussed  in 
this  report.  However,  it  is  hoped  that  the  reader  will  find  many  of  the  practices  applicable  to  their  test 
programs  and  be  able  to  improve  both  test  efficiency  and  safety  as  a  result. 
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les  Essais  en  vol  des  performances  des  systemes 
de  commande  de  vol  numeriques 
(RTO  AG-300  Vol.  21  /  SCI-034) 


Synthese 

Ce  document  couvre  un  grand  eventail  de  sujets  se  rapportant  aux  evaluations  en  vol  des  performances 
des  systemes  de  commande  de  vol  numeriques  (DFCS).  C’est  la  consequence  logique  du  fait  que  la 
complexite  technique  et  les  disciplines  associes  aux  essais  de  tels  systemes  impliquent  un  grand 
eventail  de  specialties.  La  realisation  des  essais  en  vol  d’un  DFCS  n’est  rien  moins  qu’un  probleme  de 
developpement  et  d’ integration  de  systemes.  Le  DFCS  depend  de  nombreux  autres  systemes,  sous- 
systemes  et  caracteristiques  aeronautiques  pour  pouvoir  fonctionner  et  executer  sa  mission.  Chacun  de 
ces  elements  doit  fonctionner  correctement  afin  que  F ensemble  du  DFCS  puisse  remplir  ses  fonctions. 

Ce  rapport  couvre  des  domaines  specifiques  consideres  par  F  auteur  comme  particulierement 
importants,  et  en  particulier  ceux  de  la  preparation  des  essais  et  de  F  analyse  des  donnees.  La  reussite 
d’un  programme  d' essais  en  vol  passe  en  effet  par  une  preparation  et  une  analyse  de  donnees 
adequates,  ce  qui  explique  la  large  place  accordee  a  ces  sujets  dans  le  rapport.  En  outre,  les 
consequences  d’eventuelles  erreurs  lors  des  essais  des  DFCS  peuvent  etre  catastrophiques,  entrainant 
la  perte  de  vies  et  de  materiel.  Puisque  ce  type  d'essais  en  vol  est  souvent  risque,  il  incombe  a  l’equipe 
d’ essais  de  preparer  et  d' executer  le  programme  avec  le  plus  grand  soin.  L'equipe  d’essais  doit  bien 
apprehender  le  comportement  prevu  de  l’aeronef,  son  comportement  reel,  ainsi  que  les  raisons  de  ces 
deux  comportements.  Forte  de  ces  connaissances,  elle  sera  en  mesure  de  prendre  les  bonnes  decisions 
lors  de  l’execution  du  programme  d’essais.  Sans  vouloir  reduire  l'importance  des  autres  elements 
concernes,  F  auteur  est  de  l’avis  que  la  preparation  et  F  analyse  des  donnees  sont  les  deux  aspects  les 
plus  importants  des  essais,  ce  qui  explique  l'importance  qu’il  leur  accorde. 

Enfin,  il  est  a  noter  que  les  procedures  et  les  pratiques  presentees  dans  ce  rapport  sont  la  synthese  des 
meilleures  pratiques  telles  qu’elaborees  au  fil  des  annees  par  les  specialistes  du  domaine.  Elies  ne  sont 
ni  exhaustives,  ni  completes  mais  represented  simplement  une  liste  des  pratiques  les  plus  courantes. 
Pour  des  raisons  pratiques,  il  n’y  a  jamais  eu,  et  il  n’y  aura  probablement  jamais,  de  programme 
d’essais  capable  d’incorporer  F ensemble  des  pratiques  examinees  dans  ce  rapport.  Cependant,  il  est  a 
esperer  que  le  lecteur  pourra  appliquer  un  certain  nombre  de  ces  pratiques  a  ses  programmes  d’essais  et 
ameliorer  ainsi  leur  efficacite  et  leur  securite. 


Note  de  traduction  :  F  auteur  insiste  lourdement  dans  le  2eme  paragraphe  sur  la  preparation  des  essais 
et  F  analyse  des  donnees.  Je  n’ai  pas  modifie  le  texte  mais  je  suggere  de  supprimer  la  2eme  phrase  du 
paragraphe  :  «  La  reussite  d'un  programme  d’essais  en  vol  passe  en  effet  par  une  preparation  et  une 
analyse  de  donnees  adequates,  ce  qui  explique  la  large  place  accordee  a  ces  sujets  dans  le  rapport  ». 
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Preface 


AGARDograph  Series  160  and  300 

The  Systems  Concepts  and  Integration  (SCI)  Panel  has  a  mission  to  distribute  knowledge  concerning  advanced 
systems,  concepts,  integration,  engineering  techniques,  and  technologies  across  the  spectrum  of  platforms  and 
operating  environments  to  assure  cost-effective  mission  area  capabilities.  Integrated  defence  systems,  including 
air,  land,  sea,  and  space  systems  (manned  and  unmanned)  and  associated  weapon  and  countermeasure  integration 
are  covered.  Panel  activities  focus  on  NATO  and  national  mid-  to  long-term  system  level  operational  needs.  The 
scope  of  the  Panel  covers  a  multidisciplinary  range  of  theoretical  concepts,  design,  development,  and  evaluation 
methods  applied  to  integrated  defence  systems. 

One  of  the  technical  teams  formed  under  the  SCI  Panel  is  dedicated  to  Flight  Test  Technology.  Its  mission  is  to 
disseminate  information  through  publication  of  monographs  on  flight  test  technology  derived  from  best  practices 
which  support  the  development  of  concepts  and  systems  critical  to  maintaining  NATO’s  technological  and 
operational  superiority.  It  also  serves  as  the  focal  point  for  flight  test  subjects  and  issues  within  the  SCI  Panel 
and  ensures  continued  vitality  of  the  network  of  flight  test  experts  within  NATO. 

These  tasks  were  recognized  and  addressed  by  the  former  AGARD  organization  of  NATO  in  the  form  of  two 
AGARDograph  series.  The  team  continues  this  important  activity  by  adding  to  the  series  described  below. 

In  1968,  as  a  result  of  developments  in  the  field  of  flight  test  instrumentation,  it  was  decided  that  monographs 
should  be  published  to  document  best  practices  in  the  NATO  community.  The  monographs  in  this  series  are 
being  published  as  individually  numbered  volumes  of  the  AGARDograph  160  Flight  Test  Instrumentation  Series. 

In  1981,  it  was  further  decided  that  specialist  monographs  should  be  published  covering  aspects  of  Volume  1  and 
2  of  the  original  Flight  Test  Manual,  including  the  flight  testing  of  aircraft  systems.  The  monographs  in  this 
series  (with  the  exception  of  AG  237,  which  was  separately  numbered)  are  being  published  as  individually 
numbered  volumes  of  the  AGARDograph  300  Flight  Test  Techniques  Series. 

At  the  end  of  each  AGARDograph  160  Flight  Test  Instrumentation  Series  and  AGARDograph  300  Flight  Test 
Techniques  Series  volume  is  an  annex  listing  all  of  the  monographs  published  in  both  series. 
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OVERVIEW 


This  document  covers  the  basics  of  flying  qualities  flight  testing  for  digital  flight  control  systems.  Most  of 
the  techniques  and  subjects  discussed  also  apply  to  analog  systems  as  well.  The  techniques  discussed  are 
by  no  means  the  only  techniques  available,  nor  are  they  necessarily  applicable  to  every  flight  test  program. 
Rather,  they  are  a  collection  of  best  practices  from  organizations  across  NATO,  which  practice  the  subject 
matter.  The  author  hopes  that  the  contents  of  this  text  will  provide  a  comprehensive  overview  of  the 
subject  appropriate  for  experienced  engineers,  as  well  as  provide  a  learning  source  for  those  new  to  the 
subject  matter. 
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1.0  INTRODUCTION 

This  document  covers  the  basic  technical  aspects  of  flight  testing  the  stability,  control,  and  handling 
qualities  of  the  digital  flight  control  system  (DFCS).  Significant  attention  is  given  to  test  program 
preparation.  Proper  preparation  sets  the  tone  and  flow  of  the  entire  flight  test  program  and  often  receives 
insufficient  attention.  Following  the  preparation  section,  the  discussion  will  proceed  with  the  same  level  of 
detail  to  the  execution,  analysis,  evaluation,  and  reporting  of  test  results.  The  author  will  not  attempt  to 
teach  basic  DFCS  theory  and  application.  However,  in  recognition  of  the  fact  that  the  flight  test  engineer 
may  not  have  an  in-depth  background  in  the  subject  matter  being  discussed,  simplified  examples  and 
references  will  be  liberally  used,  which  will  hopefully  direct  the  reader  toward  obtaining  the  required  skills 
and  knowledge. 

Most  of  the  skills  necessary  to  adequately  flight  test  a  DFCS  covers  the  breadth  of  the  basic  flying  qualities 
theory  and  flight  testing.  In  this  document,  flying  qualities  is  used  as  an  all  encompassing  term  to  include 
stability,  control,  maneuverability,  and  pilot-in-the-loop  handling  qualities.  Stability  and  control  will  refer 
to  the  pilot-out-of-the-loop  characteristics  of  the  aircraft,  as  an  example,  stability  margin,  control  power, 
time  to  double  or  half  amplitude,  and  time  to  roll  90  degrees.  Handling  qualities  will  be  those 
characteristics  associated  with  the  pilot  in  active  control  of  the  vehicle,  in  a  sense  closing  the  loop  on  a 
second  flight  control  system  (FCS). 

The  DFCS  flight  test  team  must  be  able  to  competently  deal  with  a  broad  range  of  engineering  disciplines, 
ranging  from  classical  stability  and  control  to  modern  systems  theory.  They  must  be  able  to  equally 
comprehend  basic  system  and  subsystem  operation,  classical,  modern,  and  digital  control  theory  as  well  as 
the  less  scientific  discipline  of  handling  qualities.  The  DFCS  flight  test  team  must  bring  to  the  problem  the 
theoretical  knowledge  of  the  design  engineer  combined  with  the  practical  and  operational  knowledge  of  a 
flight  test  engineer. 

2.0  GENERAL  CONSIDERATIONS 

2.1  Background 

Much  has  been  written  in  recent  years  regarding  flying  qualities  problems  with  the  DFCS,  in  particular, 
pilot-in-the-loop  oscillations  (PIOs).  The  implication  has  been  that  there  is  something  inherently  deleterious 
to  stability,  control,  and  handling  qualities  with  the  use  of  digital,  as  opposed  to  analog,  control  laws.  While 
the  DFCS  does  offer  some  unique  characteristics,  the  above  assumption  is  not  necessarily  warranted. 
Similar  types  of  handling  and  flying  qualities  problems  can  and  do  exist  with  analog  control  systems.  Many 
of  the  perceived  difficulties  with  DFCS  can  be  attributed  as  much  to  design  practices  and  parallel  technical 
developments  as  to  the  process  of  digitization  itself.  Most  practices  and  techniques  described  in  this 
document  can  be  equally  applied  to  analog  as  well  as  digital  systems  flight  test. 

2.2  Digital  Flight  Control  Systems  Considerations 

The  impact  of  digital  control  systems  on  aircraft  flying  qualities  can  be  broken  into  four  categories.  Two 
deal  directly  with  digital  implementation  and  the  third  involves  developments  in  airframe  technology.  The 
fourth  category  deals  with  the  improper  application  of  linear  systems  theory  to  an  inherently  nonlinear 
mechanism — the  airplane. 

The  first  major  difference  between  an  analog  and  digital  control  system  is  the  process  of  digitization  itself, 
combined  with  the  operation  of  a  digital  computer.  The  digitization  process  and  discrete  nature  of  a  digital 
computer  necessarily  leads  to  time  delays.  Time  delay  can  be  directly  related  to  increased  phase  lag,  which 
in  turn  can  adversely  impact  both  system  stability  and  handling  qualities.  Digitization  of  an  analog  signal 
adds  time  delays  since  sampled  data  are  held  constant  over  the  time  between  samples.  The  time  between 
samples  and  the  frame  rate  is  dependent  on  the  computer’s  internal  architecture  and  the  amount  of 
computations  to  be  accomplished.  In  a  digital  computer,  this  process  takes  a  finite  amount  of  time.  Another 
source  of  time  delay  is  the  input/output  process  of  the  computer.  Each  computer  takes  additional  time 
beyond  the  actual  computation  period  to  deal  with  the  input/output  communications  to  external  systems 
such  as  actuators  or  other  computers.  This  additional  delay  can  accumulate  or  increase  if  multiple 
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computers  in  series  are  used.  Most  modem  computers  have  sufficient  individual  throughput  capability  to 
minimize  the  effects  of  time  delay.  However,  system  architecture  and  the  practice  of  multiple  computers  in 
series  can,  to  some  extent,  negate  the  throughput  times  available  in  modem  computers. 

Secondly,  the  flexibility  of  the  DFCS  allows  for  more  complex  control  law  implementations  than  do  analog 
systems.  The  more  complex  implementations  can  include  nonlinear  dynamics  in  an  attempt  to  more 
accurately  represent  real  aircraft  flight  dynamics  compared  to  the  simplified,  linearized  mechanisms  in 
analog  systems.  The  increased  use  of  nonlinear  elements  can  and  does  have  a  large  beneficial  impact  on 
flying  qualities,  but  can  also  have  deleterious  effects.  Stabilization  and  control,  more  in  line  with  the 
inherent  nonlinear  flight  dynamics,  can  be  extremely  beneficial;  however,  the  lack  of  a  unifying,  nonlinear 
systems  theory  makes  analysis  and  problem  detection  difficult  in  this  type  of  system.  This,  in  turn,  can  lead 
to  unanticipated  flight  test  problems.  The  use  of  extensive  nonlinear  simulation  as  an  integral  part  of 
control  system  development  is  common  today  among  most  major  airframe  contractors.  This  is  very 
effective  in  minimizing  the  potential  negative  impacts  of  the  increased  flexibility  while  maintaining  the 
benefits.  Smaller,  inexperienced  companies  often  do  not  have  the  experience  base  and  may  tend  to 
de-emphasize  the  importance  of  nonlinear  simulation.  The  DFCS  flight  test  team  must  keep  this  in  mind 
when  preparing  for  the  test  program. 

Thirdly,  modern  technologies  emphasizing  maneuverability,  super-cruise,  and  low  observability  often  lead 
to  airframe  characteristics,  which  have  low  stability,  combined  with  low  control  surface  power.  This 
combination  usually  requires  high-gain  closed-loop  systems,  which  can  significantly  amplify  the  impact  of 
system  nonlinearities  and  structural  interactions.  Additionally,  flying  qualities  difficulties  with  high-gain 
systems  range  from  stability  problems  to  potentially  severe  handling  qualities  problems  such  as  PIO. 

Fourth,  the  misapplication  of  linear  design  and  analysis  theory  beyond  regions  of  validity,  combined  with 
the  additional  flexibility  of  the  DFCS  can  cause  problems.  Aircraft  are  inherently  nonlinear;  both  in  the 
traditional  systems  sense  (e.g.,  dead  bands,  rate  limits,  and  hysterisis),  but  also  with  respect  to  basic  flight 
mechanics.  The  six  degree-of-freedom  (6-DOF)  equations  of  motion  for  a  rigid  body  are  highly  nonlinear 
in  the  kinematics  and  can  have  significant  aerodynamic  nonlinearities.  This  aspect  is  often  ignored  or 
insufficiently  understood  and  the  aircraft  dynamics  are  simply  treated  as  linear  transfer  functions  or  set-of- 
state-space  matrices.  Application  of  linearized  equations  of  motion  and  aerodynamics  beyond  appropriate 
assumptions  can  cause  major  problems.  A  thorough  understanding  of  the  nonlinear  equations  of  motion  and 
the  applicable  range  of  valid  linearization  assumptions  is  essential  for  the  DFCS  flight  test  team.  This  is  not 
to  imply  that  linear  theory  and  analysis  is  not  useful  and  applicable  to  the  aircraft;  however,  its  application 
is  only  as  good  as  the  assumptions  made.  Violation  of  linearization  assumptions  will  result  in  invalid  design 
and  analysis  of  the  system  to  be  flight  tested.  This  problem  is  not  unique  to  the  DFCS;  however,  the 
additional  flexibility  previously  mentioned  can  exaggerate  the  problems.  Fortunately,  the  increased  use  of 
6-DOF  simulation  prior  to  flight  can  often  catch  many  of  the  errors  cause  by  the  over  simplification  of 
a  nonlinear  system. 

3.0  FLIGHT  TEST  PREPARATION 
3.1  Background 

The  role  of  proper  preparation  for  the  DFCS  flight  test  program  cannot  be  over  emphasized.  Adequate 
preparation  begins  by  obtaining  the  correct  knowledge  and  skills  and  using  this  knowledge  to  design  an 
efficient  and  safe  test  program  well  before  the  actual  flight  portion  of  the  test  program.  Knowledge  will 
increase  as  the  test  program  progresses,  and  this  knowledge  must  be  used  to  continually  re-evaluate  the 
program’s  progress.  In  order  to  provide  the  correct  understanding  of  the  system  under  test,  careful 
preparation  must  be  accomplished  from  the  initial  design  stage  through  flight  test  reporting  and  to  the  final 
system  release  for  operational  use  stage.  Lack  of  proper  preparation  will  invariably  result  in  a  poorly 
executed  test  program  and  possibly  a  poor  final  product  to  the  operational  user. 
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3.2  Understanding  the  System 

Understanding  the  system  under  test  is  key  to  the  adequate  development  of  a  ground  and  flight  test  plan  as 
well  as  evaluating  the  test  results.  Trying  to  test  a  system  with  a  black  box  mentality  of  analyzing  only  the 
inputs  and  outputs  without  understanding  the  internal  workings  will  result  in  a  poorly  designed  test 
program.  The  breadth  of  basic  knowledge  required  to  adequately  flight  test  a  DFCS  requires  a  great  deal  of 
background  education  as  well  as  practical  experience.  This  section  will  point  out  the  key  areas  of  specific 
system  knowledge  required  to  adequately  plan,  conduct,  and  evaluate  ground  and  flight  testing  of  a  DFCS. 

There  are  eight  areas  of  the  overall  aircraft  system  with  which  the  DFCS  flight  test  team  must  become 
familiar.  These  are  mass  properties,  aerodynamics,  control  laws,  actuation  systems,  structural  dynamics, 
sensors,  redundancy  management,  and  subsystems.  The  following  paragraphs  will  describe  the  key  items  of 
knowledge  required  in  each  of  these  areas. 

3.2.1  Mass  Properties 

The  mass  properties  of  interest  are  the  gross  weight,  three  axis  centers-of-gravity  (eg)  locations,  and  the 
moments  and  products  of  inertia.  The  engineer  should  be  familiar  with  the  potential  range  of  each  of  these 
variables  with  different  fuel  and  store  loadings  to  be  evaluated.  Mass  properties  directly  impacts 
performance  of  any  system,  as  they  are  physically  a  part  (along  with  aerodynamics)  of  determining  the 
unaugmented  or  bare  airframe  characteristics.  Prior  to  having  actual  hardware,  the  mass  properties  are 
usually  estimated  by  the  contractor’s  weights  group.  The  estimated  mass  properties  often  change  over  the 
course  of  the  design  process  as  the  final  system  matures.  The  estimations  range  from  broad  empirical 
estimates  in  conceptual  design,  to  very  careful  bookkeeping  of  individual  component  properties  and 
locations  as  the  design  matures.  Modern  computer-aided  design  (CAD)  systems  have  proven  to  be  very 
accurate  in  providing  the  estimated  mass  properties  for  aircraft.  When  such  systems  are  used,  they  can 
greatly  enhance  the  capability  to  predict  the  mass  properties  prior  to  having  actual  hardware.  However, 
even  when  CAD  systems  are  used,  the  final  weight  and  eg  characteristics  should  be  directly  measured  on 
scales  during  a  weight  and  balance  session.  Inertias  continue  to  be  estimated  with  an  analytical  component 
build-up  procedure.  Alternative  methods  have  been  developed  and  successfully  used  on  light  or  small 
aircraft  to  measure  the  inertias,  but  these  methods  have  not  met  with  success  when  applied  to  heavier  and 
larger  aircraft.  For  most  applications  relative  to  military  aircraft,  the  inertias  are  computed  with  a  detailed 
component  build-up  procedure. 

3.2.2  Aerodynamics 

The  DFCS  flight  test  team  should  be  familiar  with  the  general  aerodynamic  characteristics  of  the  aircraft 
across  the  flight  envelope.  This  includes  not  only  the  traditional  linear  stability  and  control  derivatives,  but 
also  the  nonlinear  characteristics.  Traditional  stability  and  control  derivatives  are  particularly  useful  within 
the  heart  of  the  normal  operating  envelope;  however,  at  the  envelope  extremes  (e.g.,  high  angle-of-attack 
[AOA]  and  large  sideslips)  their  usefulness  may  diminish  as  significant  nonlinearities  occur.  These 
nonlinearities  will  directly  impact  the  stability  and  controllability  of  the  aircraft  and  must  be  understood  in 
order  to  design  a  test  program  which  will  adequately  evaluate  the  DFCS. 

Within  the  heart  of  the  flight  envelope,  the  aircraft  aerodynamics  are  often  linear  and  may  be  well  defined 
by  the  primary  stability  and  control  derivatives.  The  DFCS  flight  test  team  should  be  familiar  with  these 
derivatives  and  their  variation  with  Mach  number,  AOA,  dynamic  pressure,  and  sideslip.  Below  are  some 
of  the  traditional  stability  and  control  derivatives  the  DFCS  flight  test  engineer  should  become  familiar 
with  for  the  airframe  of  interest. 
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lift  and  side  force  coefficients, 

Nondimensional  roll,  pitch,  and  yaw  coefficients. 
Angle  of  attack. 

Angle  of  sideslip. 

Control  surface  deflection. 

Roll,  pitch  and  yaw  rates, 

Nondimensionalized  body  axis  rates,  -5—,— — , , 

2Vt  2Vt  2Vt 

Mean  aerodynamic  chord. 

Wing  span. 

True  airspeed,  and 

Partial  derivative  operator. 
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The  primary  static  stability  derivatives  (CLa,Cma,  Cnp,  and  Clp)  determine  the  bare  airframe  static  stability. 
The  damping  derivatives  (Cmq,  Cnr,  Clr,  Cnp,  and  Clp)  will  determine  the  damping  characteristics,  and 
when  combined  with  the  static  stability  derivatives,  mass  properties  and  flight  condition  will  determine  the 
overall  bare  airframe  stability.  The  control  derivatives  (Cmg  Cng,  and  Clg),  combined  with  the  stability  and 
damping  derivatives,  will  determine  the  control  law  architecture  and  gains  required  to  achieve  the  desired 
flying  qualities.  Control  powers  are  extremely  important,  and  often  overlooked.  A  flight  control  system’s 
ability  to  provide  the  desired  flying  qualities  will  depend  on  its  ability  to  apply  the  appropriate  amount  of 
control  necessary  to  make  the  bare  airframe  act  as  desired.  Control  power  (combined  with  actuation  system 
dynamics)  is  the  hammer  of  the  flight  control  system.  The  most  intricate  and  artfully  designed  DFCS  is 
only  as  good  as  the  ability  of  the  overall  system  to  supply  sufficient  control  power  in  a  timely  fashion.  Low 
control  powers  are  becoming  more  common  as  low  observability  continues  to  dictate  airframe  design. 

While  the  linear  stability  and  control  derivatives  supply  the  DFCS  engineer  with  vital  information,  they  are 
only  a  part  of  the  story.  Aircraft  aerodynamics  are  often  nonlinear.  This  is  most  often  the  case  at  the 
extremes  of  the  envelope,  at  or  above  stall  AOA,  high  sideslip.  Nontraditional  airframe  shapes  to 
accommodate  low-observability,  post-stall  maneuvering,  can  result  in  these  nonlinearites  being  closer  to 
the  heart  rather  than  the  edges  of  the  envelope.  The  DFCS  flight  test  team  must  be  familiar  with  the 
nonlinear  characteristics  of  the  total  forces  and  moments  (usually  in  coefficient  form)  across  the  envelope. 
The  total  coefficients  are  usually  available  from  a  simulation  or  wind  tunnel  aerodynamic  model.  It  is  vital 
that  the  DFCS  flight  test  team  obtains  these  data  and  become  familiar  with  them.  The  key  force 
components  are  lift,  drag  (or  alternatively  normal  and  axial  force),  and  side  force  coefficients  (CL,  Cd  and 
Cy,  respectively).  The  key  moment  coefficients  are  pitch,  roll,  and  yaw  (Cm,  Cl,  and  Cn,  respectively).  The 
best  way  to  become  familiar  with  the  nonlinear  characteristics  is  to  plot  the  total  coefficients  as  a  function 
of  Mach  number,  AOA,  dynamic  pressure,  and  sideslip.  The  simulation  or  wind  tunnel  aerodynamic 
models  can  also  be  used  to  generate  the  linear  stability  and  control  derivatives. 
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3.2.3  Control  Laws  and  Actuation  Systems 

The  control  strategy,  or  control  laws,  will  be  determined  by  the  desired  flying  qualities,  bare  airframe 
characteristics,  available  sensor  information,  control  powers,  and  actuation  capability.  Actuation  systems 
are  an  integral  part  of  the  control  system  since  they  provide  the  means  to  provide  the  necessary  control 
deflections  as  commanded  by  the  control  laws.  An  actuation  system,  which  cannot  keep  up  with  the 
commands  from  the  control  laws,  can  significantly  degrade  the  flying  qualities.  The  DFCS  flight  test  team 
should  be  familiar  with  the  detailed  structure  of  the  control  laws,  including  key  feedback  parameters, 
command  type,  gain  structure,  and  filters  employed.  In  addition,  information  on  the  actuator  dynamics  and 
deflection  and  rate  limits  will  be  required. 

There  is  no  single  solution  to  the  design  of  control  laws  to  handle  a  given  set  of  flying  qualities 
requirements.  The  effect  of  various  feedbacks  employed  using  classical  techniques  are  well  understood 
and  documented  in  numerous  texts  on  FCS  design.  This  knowledge  is  a  result  of  many  years  of  classical 
design  experience,  combined  with  a  well-defined  linear  systems  theory.  The  basis  of  the  classical 
methodology  relies  on  single  or  simple  multiple-loop  feedbacks,  from  which  the  impact  of  individual 
feedbacks  and  gains  are  manipulated  until  acceptable  results  are  achieved.  A  direct  result  of  the 
methodology  is  system  architecture  from  which  the  impact  of  a  given  feedback  loop  is  readily  apparent. 
As  an  example,  a  roll-rate  feedback  to  the  aileron  is  a  good  indication  that  the  roll  mode  required 
augmentation.  The  impacts  of  roll-rate  feedback  to  the  aileron  on  this  mode  are  well  understood  from  the 
classical  design  theory.  Newer  or  so-called  modern  design  methods  can  change  this  character  of  the 
classically  designed  system.  Requirements  for  full-state  feedback  can  result  in  architectures  with  gains 
from  all  states  (measured  or  estimated)  to  all  surfaces.  This  type  of  architecture  can  be  difficult  to 
understand  by  the  simple  inspection  of  the  block  diagram.  It  is  not  readily  apparent  why  any  given 
feedback  signal  and  gain  is  used.  In  addition  to  this,  use  of  full-state  feedback  parameters  such  as  bank 
angle  are  usually  based  on  linearized,  small  angle  approximations  which  may  not  be  valid  throughout  the 
maneuvering  envelope.  Modern  techniques  have  found  the  most  favor  in  aircraft  FCS  designs  in  the  areas 
where  limited  envelopes  of  operation  apply,  such  as  in  autopilots.  Inner  loop,  primary  control  laws  still  tend 
to  be  designed  by  classical  techniques,  but  this  may  well  change,  as  the  more  modern  methods  become 
better  understood  by  designers. 

The  first  place  to  begin  the  familiarization  process  is  to  obtain  a  complete  and  detailed  description  of  the 
flight  control  system  from  the  designers.  This  description  should  be  of  sufficient  detail  such  that  models 
can  be  built  for  the  DFCS  flight  test  team  to  perform  both  simplified  and  detailed  analyses  of  the  system. 
All  feedbacks  and  associated  paths,  filters,  sensor  dynamics,  nonlinear  elements,  and  actuator  dynamics 
should  be  included.  With  this  information  in  hand,  combined  with  knowledge  on  the  aerodynamics  and 
mass  properties,  the  DFCS  test  team  can  begin  the  process  of  understanding  the  system. 

The  DFCS  flight  test  team  should  thoroughly  familiarize  themselves  with  the  detailed  control  laws  for  the 
aircraft.  This  is  best  accomplished  by  both  studying  the  detailed  FCS  description  and  discussing  the  design 
of  the  system  with  the  designers.  In  addition  to  studying  the  detailed  description,  the  DFCS  flight  test  team 
should  also  ask  for  access  to  all  FCS-related  analyses,  to  include  linear,  nonlinear  and  simulation  results. 
The  test  team  should  ask  the  designers  for  clarification  or  explanation  of  analysis  results  or  design 
decisions.  Understanding  why  a  system  was  designed  in  the  fashion  it  was  leads  to  a  detailed  understanding 
of  the  system  itself.  In  no  way  should  the  DFCS  flight  test  team  simply  view  the  DFCS  as  a  black  box 
understandable  only  by  the  designers.  The  team  must  become  thoroughly  familiar  with  the  design  and 
expected  operation  of  the  DFCS. 

3.2.4  Sensors 

Sensors  are  the  heart  of  any  DFCS.  The  sensors  provide  the  control  laws  with  the  information  required 
to  command  the  appropriate  surface  deflections.  The  DFCS  flight  test  team  must  familiarize  themselves 
with  the  required  sensor  suite  for  the  control  laws  to  operate.  All  sensor  sources  are  prone  to  error;  the 
criticality  of  these  errors  depends  on  the  system  characteristics.  The  subject  of  sensor  dynamics  and  design 
and  placement  is  complex,  but  the  most  critical  part  for  the  DFCS  flight  test  team  are  the  error  sources. 
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Many  design  engineers  who  are  not  completely  familiar  with  the  potential  sources  of  error  in  the  sensor 
system  sometimes  design  assuming  a  higher  fidelity  sensor  signal  than  actually  exists.  It  is  often  up  to  the 
flight  test  team  to  point  out  and  be  aware  of  potential  error  sources  and  their  impact  on  test  efficiency  and 
safety.  This  section  will  therefore  focus  on  the  potential  error  sources  that  can  impact  the  test  program. 

The  following  are  potential  critical  data  sources  for  many  control  laws: 

a.  Air  data,  airspeed,  altitude,  and  dynamic  pressure, 

b.  AOA  and  sideslip, 

c.  Body  axis  angular  rates  (p,  q,  and  r), 

d.  Body  axis  accelerations;  (Nx,  Ny,  and  Nz),  and 

c.  Euler  Angles  ( )//,  9 ,  0). 

Air  data  are  vital  to  most  control  laws  in  modern  aircraft.  Many  DFCS  gains  are  in  some  form  inversely 
proportional  to  dynamic  pressure  or  proportional  to  the  ratio  of  dynamic  pressure  to  local  static  pressure. 
They  may  be  implemented  as  such,  or  with  functions  of  Mach  number  and  pressure  altitude.  Autopilots  will 
often  use  airspeed  or  altitude  as  a  parameter  to  be  held  constant;  they  then  become  feedbacks  as  well  as 
gain  scheduling  parameters.  The  criticality  of  proper  measurement  of  airspeed,  altitude  and/or  their 
associated  pressures  will  depend  on  the  design  of  the  system  and  the  bare  airframe  dynamics.  For  aircraft 
in  which  the  control  laws  are  attempting  to  provide  stability  to  the  bare  airframe,  the  criticality  is  much 
higher  than  for  a  system  that  is  providing  limited  augmentation  of  modal  damping  (i.e.,  a  yaw  damper).  All 
air-data  measurement  systems  are  subject  to  errors.  The  type  and  severity  of  these  errors  depends  on  the 
type  of  system  and  its  placement.  Most  air  data  are  derived  from  Pitot-static  type  systems.  These  systems 
will  have  pressure  errors  at  the  static  port,  and  may  have  total  or  Pitot  errors.  The  magnitude  of  the  errors 
will  depend  on  the  placement  of  the  system  as  well  as  the  intended  flight  envelope.  Position  error 
corrections  are  often  predicted,  but  will  only  be  finally  determined  via  flight  test.  If  the  system  is  sensitive 
to  these  errors  (as  indicated  by  analyses),  then  great  care  must  be  exercised  in  planning  and  executing  the 
envelope  expansion  program.  Position  errors  are  usually  largest  at  transonic  speeds;  therefore,  initial 
envelope  expansion  flights  at  less  than  transonic  speeds  may  have  sufficient  Pitot-static  error  margin.  One 
source  of  error  often  ignored  is  Pitot  stall.  At  high  AOA  or  sideslip,  the  Pitot  tube  cannot  turn  the  flow,  and 
subsequently  stall  the  same  as  with  a  wing.  Again,  the  criticality  of  this  depends  on  the  overall  system,  but 
should  not  be  ignored  when  proceeding  to  high  AOA  testing  or  testing  in  regions  where  departure 
is  a  possibility. 

Angle-of-attack  is  another  parameter  used  for  gain  scheduling  and  is  quite  often  a  feedback  parameter. 
Measurement  of  AOA  is  also  prone  to  numerous  errors,  the  criticality  of  which  depends  on  the  system  and 
intended  flight  envelope.  Angle-of-attack  is  most  often  measured  with  fuselage  mounted  vanes,  but  other 
sources  are  also  used.  Recent  innovations  include  the  use  of  a  series  of  pressure  ports  arranged  around  the 
nose  of  the  aircraft,  commonly  called  a  flush  air  data  system  (FADS).  The  FADS  can  also  be  used  to 
measure  the  airspeed,  altitude,  and  sideslip.  Both  types  of  systems  are  prone  to  local  flow  errors.  Vanes  are 
usually  calibrated  during  flight  test,  although  initial  calibrations  are  often  analytically  predicted.  Pressure 
port  systems  usually  require  preflight  calibration  in  a  wind  tunnel  as  well  as  calibration  from  flight  test 
data.  Measurement  of  AOA  is  subject  to  induced  local  velocities  from  body  axis  angular  rates.  A  rigid  body 
rotating  about  the  eg  will  induce  velocities  off  the  eg,  which  will  appear  as  an  indicated  angle  when  local 
flows  are  measured.  These  induced  velocities  are  approximately  proportional  to  the  body  axis  angular  rate 
multiplied  by  the  distance  from  the  eg  and  inversely  proportional  to  true  airspeed.  For  a  large 
transport  type  aircraft,  where  small  body  axis  rates  are  encountered,  this  may  be  a  small  problem. 
However,  for  fighter  aircraft  with  large  rates,  particularly  at  low  airspeeds,  body  axis  rotational  rates  can 
induce  large  errors. 

Sideslip  is  a  parameter  rarely  used  to  date  as  a  feedback  parameter  because  of  the  difficulties  in  obtaining 
accurate  measurements.  This  may  drastically  change  on  future  aircraft  as  bare  airframe  directional  stability 
is  sacrificed  to  obtain  low  observability.  Sideslip  is  measured  in  much  the  same  way  as  AOA,  with  either 
vane  or  pressure  ports.  Measurement  of  sideslip  is  prone  to  the  same  errors  as  AOA,  but  is  often  much 
more  sensitive  to  local  and  induced  flows.  While  local  flow  effects  may  be  on  the  order  of  10  to  20  percent 
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for  an  AOA  vane,  they  may  be  as  high  as  50  percent  for  a  sideslip  vane.  In  addition,  convenient  location  of 
multiple  sources  is  not  as  easy  as  for  an  AOA  vane.  In  spite  of  these  difficulties,  a  source  of  sidelsip 
measurement  is  in  most  cases  required  to  stabilize  a  bare  airframe  directional  instability;  therefore,  their  use 
may  well  increase  in  the  future. 

Body  axis  angular  rates  are  probably  the  most  common  and  one  of  the  oldest  sensor  sources  used.  Accurate 
measurement  is  possible  with  high  fidelity  rate  gyros.  Sensor  location  can  be  a  problem  if  significant 
structural  modes  are  present.  For  most  fighter  aircraft,  the  airframe  is  usually  sufficiently  rigid  to  have  the 
structural  frequencies  well  above  the  primary  DFCS  frequencies.  This  allows  the  use  of  notch  filters  to  help 
eliminate  structural  interaction.  The  same  is  not  necessarily  true  for  large  transport  aircraft.  For  these 
aircraft,  the  structural  frequencies  are  often  in  a  range  of  control  required  by  the  FCS,  thus  eliminating  the 
ability  to  use  notch  filters.  In  addition,  these  aircraft  can  have  widely  varying  structural  modes,  with 
varying  nodes  and  antinodes  as  fuel  is  burned.  The  potential  advent  of  low-weight  and  low-observable 
structures  combined  with  active  structural  control  will  even  further  increase  the  importance  of  angular  rate 
sensor  placement. 

Body  axis  translation  accelerations  are  also  common  and  long  used  sensors.  These  sensors  are  prone  to 
measurement  error  dependent  on  location.  Error  sources  are  induced  accelerations  due  to  rigid  body  motion 
and  structural  dynamics.  The  same  problems  relative  to  notch  filtering  for  the  accelerometers  exist  as  for 
the  body  axis  angular  rates.  Body  axis  measured  translation  accelerations  suffer  from  incorrect 
measurements  when  not  located  at  the  eg.  Fortunately,  the  error  associated  with  off  eg  rigid  body 
measurements  can  be  applied  to  the  benefit  of  the  control  laws.  Most  aircraft  place  the  accelerometers  well 
ahead  of  the  eg,  which  provides  some  lead  to  the  signal,  and  can  enhance  the  ability  of  acceleration 
measurements  to  provide  augmentation.  However,  the  converse  of  placing  the  accelerometers  aft  of  the  eg 
can  have  a  significant  destabilizing  impact. 

Euler  angles  or  body  axis  attitudes  with  respect  to  the  local  horizontal  are  perhaps  the  oldest  forms  of 
sensor  signals  used  in  flight  control  systems.  Attitudes  are  easily  measured  with  mechanical  attitude  gyros, 
or  as  is  the  common  practice  today,  with  strap  down  rate  gyros  integrated  to  obtain  attitudes.  Their  use  is 
generally  limited  to  outer  loop  autopilots,  but  in  proper  form  can  also  be  used  in  inner  loop  augmentation. 
The  use  of  bare  Euler  angles  (their  use  in  a  nontrigonometric  form)  is  only  applicable  in  flight  regimes 
where  small  angle  approximations  are  valid.  The  bare  form  may  be  fine  for  large  transport  aircraft,  which 
are  not  highly  maneuverable,  but  can  quickly  create  problems  for  fighter  or  trainer  aircraft  where  their  use 
as  bare  angles  violates  small  angle  approximations.  When  used  in  an  inner  loop  or  even  in  an  autopilot  in 
their  bare  form,  they  should  always  be  in  conjunction  with  code  to  disengage  when  large  bank  angles  or 
pitch  attitudes  are  encountered.  The  problems  with  bare  Euler  angles  arise  from  linear  analysis  theory.  The 
Euler  angles  only  appear  in  the  6-DOF  equations  of  motion  in  trigonometric  form  (e.g.,  cos,  sin).  Their  bare 
use  arises  from  small  angle  approximations  used  in  linear  theory  where  the  sin  is  approximately  equal  to 
the  angle  and  the  cosine  is  equal  to  unity.  Consequently,  the  use  of  the  bare  angles  rapidly  looses  validity 
when  small  angle  approximations  are  used. 

3.2.5  Redundancy  Management 

Redundancy  management  (RM)  or  failure  detection  and  management  is  a  critical  element  of  any  DFCS. 
Critical  sensors,  computers  or  communications  paths  are  all  considered  in  RM  schemes.  Since  any  system 
is  subject  to  failure,  detection  and  handling  of  these  failures  is  critical  to  the  operation  of  a  DFCS.  This  is 
particularly  true  of  systems  under  development.  New  and  unproven  systems  under  development  are  far 
more  likely  to  encounter  failures  than  mature  systems.  For  this  reason,  the  DFCS  flight  test  team  must  be 
familiar  with  the  RM  scheme  employed  by  their  particular  system,  its  intended  operation  and  potential 
weaknesses.  Redundancy  management  is  another  complex  subject  with  as  many  schemes  as  there  are  flight 
control  systems.  However,  in  spite  of  this,  most  have  some  common  basic  operating  principles. 

The  RM  system  is  usually  designed  to  provide  either  fail  operational  or  fail  safe  operating  states.  Fail 
operational  means  that  any  failure,  or  set  of  failures,  will  be  detected  and  isolated  so  that  the  basic  mission 
is  not  compromised.  Fail  safe  means  that  any  failure,  or  set  of  failures,  will  result  in  a  vehicle  safe  to 
operate  and  return  to  base,  but  the  mission  may  be  compromised.  Most  design  specifications  for  operational 
aircraft  define  a  set  number  of  critical  failures  to  be  fail  operational  and  specified  subsequent  failures  to  be 
fail  safe.  The  general  premise  is  that  no  single  failure  should  cause  loss  of  mission,  and  multiple  failures 
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must  be  encountered  to  significantly  reduce  the  safety  of  flying.  The  methods  used  to  achieve  this 
capability  usually  involve  multiple  or  redundant  systems  with  sophisticated  software  to  detect  and  isolate 
failures.  The  process  of  isolation  often  implies  a  process  of  elimination.  As  an  example,  if  three  signals  are 
available,  and  one  is  substantially  different  from  the  other  two,  than  chances  are  the  odd  signal  is  bad  and 
can  be  ignored.  Conversely,  if  only  two  signals  are  available,  detection  of  the  bad  signal  is  almost 
impossible  without  some  third  comparison  source.  The  probability  of  selecting  the  correct  value  increases 
as  the  number  of  redundant  signals  or  processes  increases.  Most  modern  DFCS  systems  are  either  triplex  or 
quadroplex;  triplex  referring  to  three  separate  systems  and  quadroplex  to  four.  The  redundancy  level  often 
includes  critical  sensors,  computers  and  communication  paths,  but  may  not  include  sub-critical  paths. 

Analysis  to  determine  the  critical  paths,  probability  of  occurrence  and  the  outcome  of  an  occurrence  is 
accomplished  via  failure  modes  and  effects  analysis  (FMEA).  This  analysis  ranges  from  examination  of  the 
block  diagrams  all  the  way  to  evaluating  failures  via  6-DOF  simulations.  The  results  of  these  analyses  will 
identify  the  critical  paths  and  the  consequences  of  failures  occurring.  Large  contractors  usually  employ 
experts  in  FMEA  and  failure  modes  and  effects  testing  (FMET),  which  will  provide  a  thorough  analysis  of 
the  system  under  consideration.  Smaller  contractors  or  projects  may  not  have  sufficient  resources  at  hand, 
and  the  job  may  well  fall  to  the  DFCS  flight  test  team  to  determine  critical-failure  paths  and  effects.  Failure 
mode  analysis  usually  starts  at  the  component  level,  then  progresses  into  the  subsystem  and  finally  to  the 
entire  system.  The  desire  is  to  achieve  a  probability  of  occurrence  of  a  top-end  state. 
The  top-end  state  can  range  from  failure  to  achieve  the  mission  to  loss  of  the  aircraft.  A  technique  called 
fault-tree  analysis  is  used  to  provide  detailed  analysis  of  potential  failure  states  and  their  consequences.  The 
fault  tree  is  a  diagram  progressing  from  the  simplest  component  (i.e.,  a  rate  gyro)  or  components 
and  proceeds  to  the  top-end  event.  There  may  be  several  layers  or  levels  of  events,  each  of  which  is 
combined  to  provide  the  probability  of  loss  of  mission  or  aircraft.  Figure  1  shows  a  simplified  example  of 
such  an  analysis. 


The  use  of  AND/OR  gates  are  elemental  to  this  analysis.  Component  level  probabilities  of  failure  such  as 
the  gyros  in  Figure  1  are  determined  by  component  bench  testing  and  includes  operational  data  if  available. 
The  AND  gates  signify  multiple  failures  required  to  achieve  the  failure  level  (gyro  or  accelerometer  failure 
Figure  1).  For  AND  gates,  the  probabilities  are  multiplied  together,  reducing  the  probability  of  occurrence 
since  the  probabilities  are  all  less  than  unity.  The  OR  gates  are  indicators  of  potential  single  point  failures, 
either  event  A  OR  event  B  can  result  in  the  top  end  event  occurring.  The  probabilities  of  each  are  added 
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through  these  gates,  increasing  the  chance  of  occurrence.  The  loss  of  a  single  airspeed  data  source  of  Figure 
1  is  an  example  of  OR  gate  operation.  A  series  of  OR  gates  unbroken  by  an  AND  gate  is  an  indication  of  a 
potential  single  point  failure.  The  presence  of  a  series  of  OR  gates  in  such  an  analysis  should  always  be 
investigated.  The  DFCS  flight  test  team  needs  to  be  familiar  with  the  FMEA  analysis  and  the  potential 
failure  states,  which  can  degrade  system  operation  or  safety. 

A  few  words  concerning  the  magnitude  of  the  final  numbers  of  an  FMEA  are  in  order.  Many  times 
the  results  of  such  an  analysis  will  indicate  that  the  chances  of  a  particular  failure  are  10'8  per  flight  hour, 
or  that  it  would  take  108  flight  hours  to  occur.  This  implies  that  an  aircraft,  which  may  have  a  20,000 
or  even  a  200,000-hour  service  life,  will  never  see  this  occurrence.  These  numbers  imply  that  the  event 
will  only  occur  roughly  once  in  every  105  years.  The  numbers  must  not  be  taken  literally,  but  respectively, 
i.e.,  a  10"8  occurrence  is  100  times  less  likely  than  a  10’6  occurrence.  They  must  also  be  taken  in  relation  to 
some  event.  As  an  example  if  the  probability  of  loss  of  aircraft  is  10’8  per  flight  hour  due  to  a  complete 
failure  of  the  gyros,  it  means  just  that.  It  does  not  mean  that  you  can  fly  many  aircraft  for  108  hours  without 
a  crash.  The  goal  is  to  reduce  the  numbers  to  very  small  values  to  ensure  the  safety  of  the  system.  At  some 
point,  (while  the  math  may  give  a  small  probability  value),  the  numbers  lose  all  absolute  meaning  and 
become  valid  only  for  relative  comparisons. 

The  failure  modes  effect  testing  (FMET)  is  testing  for  the  impact  of  failures  by  failing  critical  paths 
(indicated  by  the  FMEA)  via  simulation.  In  many  cases,  the  criticality  of  any  given  failure  must  be 
determined  by  testing,  and  these  results  fed  back  into  the  FMEA  analysis.  Testing  or  other  analysis  must 
often  be  conducted  to  verify  the  top  end  events  of  the  FMEA.  Conversely,  the  initial  consensus  may  be  that 
the  aircraft  will  not  lose  control  with  the  loss  of  all  three  gyros,  but  simulation  testing  indicates  that  this 
will  occur,  with  a  low  chance  of  recovery  and  a  potential  loss  of  the  aircraft.  Failure  modes  effect  testing  is 
most  often  accomplished  in  a  simulation  with  or  without  actual  hardware-in-the-loop.  All  critical  paths 
should  be  explored  to  verify  the  FMEA  and,  if  necessary,  the  FMEA  should  be  updated  to  reflect  these 
results. 

An  often-neglected  path  in  the  FMEA  is  software  failures.  The  FMEA  does  not  always  apply  to  the 
software  itself,  but  assumes  that  the  ability  to  detect  and  isolate  the  failures  exists.  The  simplified  example 
of  Figure  1  does  nothing  to  indicate  the  probability  of  the  failures  going  undetected.  For  this  reason, 
undetected  failures  are  often  analyzed  during  the  FMET  phase.  This  area  is  important  and  should  not  be 
neglected.  The  reason  for  nondetection  of  failures  can  be  numerous,  and  are  often  the  result  of  the  actual 
failure  scheme  and  software  employed. 

3.2.6  Subsystems 

Subsystems  such  as  hydraulics,  power  supplies,  and  environmental  controls  are  vital  to  the  operation  of 
any  DFCS.  For  this  reason,  the  DFCS  flight  test  team  should  familiarize  themselves  with  the  primary 
and  backup  systems  for  each.  The  hydraulic  and  electrical  power  supply  systems  will  determine  if  the 
DFCS  can  manipulate  the  control  surfaces  through  sufficient  range  and  at  a  sufficient  rate  to  provide  the 
desired  flying  qualities.  Backup  systems  are  quite  often  not  as  capable  as  the  primary  system,  and  can  lead 
to  problems. 

The  hydraulic  requirements  are  usually  given  in  terms  of  the  pressure  and  flow-rate  (gallons/minute) 
capability  of  both  the  primary  and  backup  systems.  Without  sufficient  pressure  or  flow  rate,  the  surfaces 
cannot  move  across  the  required  range  nor  can  they  get  to  a  given  position  quickly  enough 
to  provide  the  desired  flying  qualities.  The  pressure  and  flow  rate  is  typically  generated  by  engine-driven 
hydraulic  pumps.  Backup  hydraulic  power  may  be  supplied  by  an  auxiliary  power  unit  (APU),  which 
is  separate  from  the  engine-driven  systems,  and  used  in  case  of  engine  failure.  Most  modern  aircraft 
have  dual  and  independent  primary  hydraulic  power  supplies  leading  to  each  actuator.  They  are  designed 
to  act  independently  in  case  of  failure  of  a  single  system.  However,  when  operating  at  this  reduced 
capacity,  the  overall  range  of  movement  and  rate  capability  is  usually  one-half  of  the  nominal  dual  system. 
This  can  have  significant  deleterious  impacts  on  the  flying  qualities  of  the  aircraft.  In  the  near  future, 
electromechanical  actuation  systems  may  be  used.  These  systems  do  away  with  the  need  for  an  aircraft 


10 


hydraulic  network  and  are  actuated  electrically.  At  this  writing,  these  systems  are  under  test. 
Electromechanical  systems  typically  consist  of  high  power  electrical  motors,  which  operate  a  miniature 
hydraulic  system  contained  within  the  actuator  in  order  to  move  the  surface.  In  this  sense,  they  are 
hydraulic  systems,  but  do  away  with  the  need  for  a  centralized  hydraulic  pump,  reservoirs,  accumulators, 
and  associated  plumbing. 

The  electrical  power  supply  is  critical  to  not  only  powering  the  aircraft  subsystems,  but  also  for  powering 
the  flight  control  computers  and  portions  of  the  integrated  servo  actuators.  Most  systems  will  have  a 
primary  and  secondary  electrical  supply  Bus  that  distributes  the  power  to  the  aircraft  systems.  Most  of  the 
flight  critical  functions  are  contained  on  a  single  Bus  for  power  distribution  to  such  items  as  the  flight 
controls,  actuators,  and  critical  computers.  Most  DFCS  systems  have  a  battery  backup  to  operate  the  flight 
control  computers  for  a  period  of  time  in  the  case  of  power  interruption.  Like  the  hydraulic  systems,  an 
APU  may  also  be  used  with  a  separate  generator  to  supply  electrical  power  in  the  event  of  an  engine  loss. 
This  backup  generator  is  typically  much  less  capable  than  the  primary  engine-driven  generators,  and  hence 
usually  only  supplies  power  to  the  critical  flight  functions. 

The  APU  is  a  critical  part  of  any  single  engine  DFCS  equipped  aircraft.  They  are  necessary  on  single 
engine  aircraft  due  to  relatively  poor  engine  reliability  when  compared  to  other  systems.  Engine  failures 
occur  about  once  every  10,000  flight  hours  (10"4/hr),  which  is  generally  a  much  higher  failure  rate  than  is 
acceptable  in  critical  aircraft  systems  design.  In  order  for  the  engine  to  not  be  considered  a  single  point 
failure,  an  APU  is  used  to  supply  critical  power  in  order  to  recover  the  aircraft.  The  need  for  an  APU  on  a 
multi-engine  aircraft  depends  on  the  overall  system  design  and  subsystem  redundancy  supplied  by  the 
multiple  engines. 

3.3  Predict,  Test,  Model  Update  and  Validate  Philosophy 
3.3.1  Background 

Flight  controls  and  flying  qualities  flight  testing  have  traditionally  used  a  philosophy  of  predict,  test,  model 
update  and  validation  for  years.  The  primary  reason  for  employing  this  philosophy  is  that  it  has  proven 
to  be  the  safest  and  most  efficient  method  for  expanding  the  envelope  of  any  new  aircraft.  It  also  provides 
validated  models  that  will  reduce  the  time  and  money  in  designing  and  developing  future  upgrades.  The 
predict,  test,  update  and  validate  philosophy  is  nothing  more  than  a  scientific  method.  Predictions  are  the 
hypothesis,  test  is  putting  the  hypothesis  to  the  test,  updating  is  using  the  test  results  to  create  an  improved 
hypothesis  and  validating  is  ensuring  that  the  final  hypothesis  is  valid  across  the  range  of  applicability.  In 
the  case  of  DFCS  flight  testing,  the  hypothesis  consists  mainly  of  system  models  for  such  things  as 
aerodynamics,  mass  properties,  control  laws,  and  actuation  systems.  Test  is  the  combined  ground  and  flight 
test  program,  updating  is  feeding  the  results  of  the  tests  back  into  the  models  and  repredicting,  and  finally, 
validation  is  the  process  of  providing  valid  system  models  at  the  end  of  the  flight  test  program. 

Virtually  every  model  used  in  the  initial  design  process  is  a  predictive  model  with  varying  levels  of 
accuracy  depending  on  the  prediction  method  used.  Because  of  this,  models  can  contain  large  uncertainties, 
which  may  show  up  as  DFCS  design  deficiencies.  Uncertainty  and  deficiencies  are  the  primary  drivers  in 
the  time  and  effort  required  to  conduct  a  flight  test  program.  Reducing  this  uncertainty,  and/or  discovering 
deficiencies  as  early  as  possible  will  provide  the  safest  and  cheapest  test  program.  In  today’s  test 
environment  there  is  a  current  trend  in  accepting  increased  risk  in  order  to  cut  the  cost  of  testing.  This  may 
hold  true  to  a  degree,  but  one  only  has  to  ask  the  program  that  has  crashed  a  test  aircraft  how  much  money 
they  saved  by  accepting  increased  development  risk.  The  financial  cost  of  the  aircraft,  delayed  schedules 
and  political  costs  of  a  major  accident  can  often  far  outweigh  the  savings  projected  by  skipping  steps  in  the 
predict,  test,  update  and  validate  philosophy.  Fortunately,  today’s  computer  technology  allows  significantly 
increased  ability  to  implement  this  test  philosophy  in  a  rapid  and  cost-effective  manner.  Benefits  from  the 
use  of  modeling  and  simulation  (M&S)  have  been  known  to  the  FCS  community  for  many  years,  and  its 
use  will  significantly  increase  in  future  years.  The  current  push  towards  increased  use  of  M&S  in  testing  is 
nothing  more  than  implementing  the  predict,  test,  update  and  validate  philosophy  across  a  wider  range  of 
disciplines. 
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There  are  four  basic  ways  in  which  this  philosophy  can  reduce  risk  and  schedule.  The  first  way  is  that  the 
philosophy  begins  on  the  ground,  helping  to  find  problems  early  and  in  a  safe  environment.  Many  problems 
with  integration,  structural  coupling,  and  erroneous  code  can  be  found  before  flight.  The  second  way  the 
philosophy  reduces  risk  is  by  incrementally  updating  predictive  models,  and  using  the  knowledge  to 
extrapolate  to  future  tests,  again  in  an  attempt  to  preempt  potential  problems.  The  third  way  the  philosophy 
enhances  the  overall  safety  and  efficiency  is  by  insuring  updated  models  for  correcting  deficiencies  when 
they  arise.  Using  updated  and  validated  models  to  correct  deficiencies  reduces  the  uncertainty  in  any 
redesign  effort.  This  not  only  applies  for  an  envelope  expansion  program,  but  is  also  valid  over  the  life 
cycle  of  the  aircraft.  Future  upgrades  can  be  made  with  less  uncertainty  and  cost  when  using  validated 
models.  The  final  area  the  philosophy  helps  is  in  reducing  the  need  for  certain  tests.  Many  tests  are  too 
hazardous  or  expensive  to  perform.  This  type  of  testing  can  often  be  accomplished  using  validated  models 
and  simulation. 

Modeling  and  simulation  use  in  applying  the  above  philosophy  has  been  used  to  varying  degrees  for  years 
in  flight  control  development  and  testing.  The  prediction  portion  of  the  philosophy  has  been  a  major  player 
in  flight  control  development  for  years.  Unfortunately,  the  application  of  the  philosophy  often  ends  at  this 
stage.  The  practice  of  testing,  and  specifically  testing  to  update  and  validate  models  is  not  widely 
embraced.  There  is  often  every  intention  of  updating  and  validating  models,  but  this  often  goes  by  the 
wayside  under  the  pressures  of  conducting  and  producing  flight  hours  as  opposed  to  test  results.  Experience 
has  shown  that  one  of  the  prime  reasons  for  not  pursuing  an  intended  philosophy  such  as  described  here  is 
the  lack  of  preparation.  If  a  test  program  plans  to  use  the  predict,  test,  update,  and  validate  philosophy,  then 
the  DFCS  flight  test  team  must  become  involved  early  in  the  project.  They  must  ensure  that  the  proper 
tools,  tests  and  schedule  are  available  to  be  implemented.  Without  this  early  involvement,  the  best 
intentions  to  use  the  philosophy  will  not  be  realized.  Preparation  and  planning  are  required  early  in  the 
development  cycle  to  ensure  that  the  process  will  proceed. 

3.3.2  Predictions 

Prediction  is  an  area  where  most  military  airframe  contractors  excel.  This  is  especially  true  for  major  new 
development  programs,  which  have  modern  resources  available.  Prediction  may  not  be  as  sound  if  dealing 
with  an  upgrade  of  an  older  or  existing  system,  or  if  it  is  an  off-the-shelf  acquisition  of  a  commercial 
system.  Historically,  the  general  aviation  community  has  not  had  the  resources  to  do  extensive  predictions. 
As  an  example,  one  would  be  hard  pressed  to  find  a  predicted  or  validated  simulation  aerodynamic  model 
for  a  Cessna  150.  Similarly,  validated  models  for  older  aircraft  may  not  be  available,  and  the  original  wind 
tunnel  or  other  predictive  data  may  be  long  lost.  The  ability  to  adequately  predict  expected  performance  is 
wholly  dependent  on  models  and  the  fidelity  of  these  models.  This  does  not  mean  that  predictions  are  not 
worthwhile  if  high  fidelity  or  validated  models  are  not  available,  it  simply  means  that  the  predictions  will 
have  greater  uncertainty,  and  that  this  must  be  accounted  for  in  the  test  program. 

The  first  step  in  the  prediction  process  is  to  determine  what  models  have  been  generated,  what  is  their 
source,  and  some  assessment  of  their  fidelity.  As  an  example,  a  major  military  airframe  contractor 
may  have  thousands  of  hours  of  wind  tunnel  testing  behind  their  aerodynamic  models,  while  a  general 
aviation  contractor  may  only  have  estimated  aerodynamics  based  on  empirical  methods.  The  level 
of  fidelity  is  obviously  different  between  the  two  methods.  Models  are  absolutely  necessary  for  the  design 
of  any  full  authority,  fly-by-wire  DFCS,  since  the  system  cannot  be  properly  designed  without  these. 
The  need  for  predictive  models  may  become  less  necessary  if  the  DFCS  being  designed  is  a  low-gain, 
outer-loop  system  such  as  a  simple  wing  leveler  autopilot  for  general  aviation  aircraft.  In  this  case,  since 
the  system  does  not  fully  control  the  entire  stability  and  control  aspects  of  the  aircraft,  and  can  be  readily 
disengaged,  then  simply  installing,  testing,  and  adjusting  components  empirically  may  suffice.  This  is 
not  necessarily  the  best  or  most  efficient  way  to  proceed,  but  until  recently  it  has  been  the  only  way  to 
do  the  job  for  many  of  these  type  systems.  However,  today’s  cheap  computer  power,  combined  with  a 
myriad  of  predictive  software,  makes  this  a  case  of  not  willing  to  invest  the  time  and  effort  as  opposed  to  a 
case  of  not  being  able  to  do  the  analysis. 
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The  required  predictive  models  vary  with  the  complexity  of  the  system;  however,  there  are  a  few  major 
models  which  the  DFCS  test  team  will  require  to  adequately  perform  or  participate  in  the  predictive  task. 
These  models  are:  aerodynamics,  mass  properties,  control  laws,  actuator  and  expected  time  delays.  The 
aerodynamic  mass  properties  and  control  law  models  are  the  most  vital,  followed  by  the  actuator  models. 
Aerodynamics  are  usually  predicted  via  wind-tunnel  tests,  past  flight  tests,  or  by  empirical  methods.  The 
level  of  uncertainty  in  the  aerodynamics  is  possibly  the  biggest  potential  problem  for  the  DFCS  test  team. 
The  mass  properties  models  usually  have  about  a  10-  to  15 -percent  uncertainty;  however,  the  level  of 
uncertainty  is  reducing  as  sophisticated  CAD  systems  are  increasingly  being  used  for  design.  The  final 
gross  weight  and  eg  properties  can  be  verified  by  weighing  the  actual  aircraft  prior  to  flight.  The  inertias 
will  tend  to  maintain  their  predictive  level  of  uncertainty  since  adequate  techniques  (except  in  a  few 
instances)  for  measurement  are  not  available.  The  control  laws  are  usually  known  from  the  design  effort, 
but  are  only  as  good  as  the  aerodynamics.  The  actuator  models  and  time  delays  can  be  ground  tested  prior 
to  flight,  and  while  accurate  models  may  not  be  available  early  on  in  the  process,  the  DFCS  test  team 
should  attempt  to  validate  and  update  these  models  from  the  results  of  ground  tests  prior  to  flight. 

The  next  step  in  prediction  is  to  assemble  component  models  available  into  a  model  of  the  system,  then  use 
this  model  to  predict  performance.  Following  this,  the  models  should  be  placed  into  some  form  of 
simulation  from  which  the  predictions  of  performance  are  generated.  The  simulation  may  be  as  complex  as 
a  full  man-in-the-loop  mission  simulator  or  as  simple  as  using  a  few  stability  and  control  derivatives,  a 
piece  of  paper  and  a  pencil  to  predict  the  Dutch-roll  natural  frequency. 

The  importance  of  having  simulation  capability  at  the  test  site  cannot  be  over  emphasized.  The  DFCS  test 
team  is  responsible  for  the  successful  and  safe  completion  of  the  test  program.  The  ready  availability  of 
simulation  to  predict  and  to  compare  with  actual  test  results  is  vital  to  this  function.  Many  program 
managers  or  contractors  do  not  fully  appreciate  the  benefits  of  on-site  simulation  to  the  success  of  the  test 
program.  The  DFCS  engineer  must  often  work  hard  to  convince  program  management  of  the  benefits  of 
on-site  simulation. 

3.3.3  Test 

The  testing  process  is  where  the  data  are  collected  not  only  to  verify  system  performance,  but  also  to  start 
updating  and  validating  system  models.  Attention  must  be  applied  to  the  types  and  quality  of  tests  to  not 
only  ensure  the  appropriate  data  are  collected  to  verify  system  performance,  but  also  that  appropriate  data 
are  collected  to  be  able  to  update  and  validate  final  models.  Specific  test  techniques  are  often  required  to 
perform  model  updating,  which  may  not  be  otherwise  required.  As  an  example,  simply  performing  classical 
flight  test  maneuvers  may  not  provide  sufficient  information  to  update  the  aerodynamic  model.  Specialized 
test  inputs  may  be  required  to  adequately  define  the  system  aerodynamics  from  flight.  Many  of  these 
maneuvers,  such  as  separate  surface  inputs,  may  not  be  necessary  to  evaluate  the  overall  system 
performance,  but  may  be  absolutely  necessary  to  adequately  define  the  aerodynamics. 

Implementing  the  predict,  test,  update,  validate  philosophy  starts  with  ground  tests  long  before  the  flight 
tests  begin.  Adequate  ground  testing  must  be  planned  to  ensure  the  correct  data  are  obtained  from  which 
predictive  models  can  be  validated  and/or  updated.  Sufficient  time  must  be  allowed  for  the  proper  analysis 
of  the  results  and  retest  if  necessary.  Often  the  time  crunch  experienced  by  almost  all  test  programs  will 
result  in  skipping  what  are  viewed  as  non-necessary  tests;  in  order  to  meet  the  bare  minimum  of 
requirements  on  schedule.  This  can  often  be  alleviated  by  early  planning  and  scheduling  in  order  to  allow 
for  sufficient  time  to  perform  the  testing  required  to  implement  the  philosophy. 
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3.3.4  Updating 

Updating  predictive  models  is  the  foundation  for  adequately  applying  the  predict,  test,  update  and 
validation  test  philosophy.  Without  this  portion  of  the  philosophy,  additional  risk  and  inefficiencies  will  be 
experienced  by  the  test  program.  The  test  team  must  ensure  that  the  preparations  are  in  place  to  adequately 
employ  the  updating  process.  The  DFCS  test  team  will  most  likely  be  involved  in  updating  aerodynamic 
models  from  flight  test  as  well  as  any  control  law  or  subsystem  models.  The  key  to  updating  the  models, 
which  are  based  on  the  test  data,  is  early  preparation.  The  DFCS  test  team  must  decide  which  models  will 
require  updating  from  both  ground  and  flight  tests.  They  must  then  ensure  that  provisions  are  made  in  the 
models  to  allow  for  updating.  For  example,  most  aerodynamic  models  are  in  total  coefficient  form,  and  are 
not  easily  updated  with  stability  and  control  derivatives  derived  from  flight  test.  The  DFCS  test  team  must 
devise  and  implement  methods  for  integrating  these  nonsimilar  data  types. 

The  update  process  begins  with  the  ground  test;  however,  this  work  is  mostly  done  by  the  design  and 
specific  ground  test  engineers.  As  with  all  other  aspects  of  applying  the  predict,  test,  update,  and  validate 
philosophy,  early  planning  is  essential.  In  order  for  updating  of  models  to  be  accomplished,  the  proper 
tests,  data  and  analysis  tools  must  be  available.  The  DFCS  test  team  must  decide  on  what  algorithms  or 
methods  will  be  used  to  extract  parametrics  and  model  updates  from  test  data,  and  then  ensure  that 
appropriate  tests  are  performed  across  a  sufficient  range  to  allow  the  techniques  to  work.  In  addition,  the 
team  must  also  postulate  a  model  update  form  and  some  methodology  to  incorporate  the  test  data  into  the 
models.  In  some  cases,  this  will  be  straight  forward,  but  in  other  cases,  such  as  highly  nonlinear  systems,  a 
great  deal  of  thought  and  planning  may  be  required.  The  system  should  then  be  exercised  prior  to  the  actual 
start  of  testing.  If  available,  simulator  data  can  provide  a  good  data  source  for  exercising  the  system. 

Once  flight  test  starts,  the  aerodynamic  model  must  be  evaluated  and  updated  as  the  envelope  expansion 
progresses.  There  are  many  software  algorithms  that  have  been  developed  over  the  years  to  estimate  the 
aerodynamics  from  flight  test  data.  These  range  from  linear  derivative  estimators  such  as  the  Modified 
Maximum  Likelihood  Estimator  ( Identification  of  Dynamic  Systems,  Theory  and  Formulation,  Reference 
1)  too  more  complex,  full  envelope,  nonlinear  model  development  algorithms.  The  advantages  of  the  latter 
are  that  they  can  produce  full  nonlinear  models  and  the  engineer  does  not  have  to  extrapolate  or  incorporate 
locally  linearized  data  into  a  nonlinear  model.  The  disadvantages  are  that  they  usually  require  large  sets  of 
data  before  the  nonlinear  updating  can  begin.  The  linear  derivative  extractors  have  the  advantage  of  being 
able  to  estimate  locally  linear  derivatives  on  a  test  point  by  test  point  basis.  The  disadvantages  are  that  they 
are  locally  linearized  results,  and  their  validity  at  conditions  beyond  small  variations  from  the  test  condition 
depend  on  the  linearity  of  the  system’s  aerodynamics.  Another  disadvantage  is  that  they  must  often  be 
incorporated  into  a  nonlinear  model,  which  can  be  a  difficult  task.  Both  methods  will  only  supply  data  in 
regions  where  the  system  is  tested;  extrapolation  to  regions  beyond  where  tests  have  occurred  is  often  up  to 
the  engineer  doing  the  updating.  When  extrapolating  to  regions  not  tested  (as  an  example  to  high  sideslips), 
the  wind-tunnel  data  can  often  give  the  engineer  an  indication  of  the  general  shape  of  the  function.  This 
shape  should  be  followed  wherever  possible  unless  direct  flight  test  results  contradict  the  original  shape. 
There  is  some  danger  that  these  extrapolations  will  not  be  valid.  Any  updated  model  must  contain 
documentation  which  details  which  data  are  from  actual  tests,  which  are  extrapolated  and  what  the 
extrapolation  is  based  upon. 

3.3.5  Validating 

Validation  is  the  final  graduation  exercise  for  the  updated  model.  The  model  must  adequately  predict 
system  performance  over  a  wide  range  of  tests.  Many  of  these  tests  may  or  may  not  have  been  used  to 
develop  the  new  model.  The  key  to  a  solid  validation  is  the  model's  ability  to  represent  the  system  under 
test.  The  final  validation  checks  must  be  carefully  planned  to  account  for  the  operating  range  of  the 
systems,  and  to  account  for  nonlinearities  in  system  characteristics.  As  an  example,  just  matching  the 
response  to  small  amplitude  doublets  is  insufficient  to  ensure  the  model’s  validity.  Full  amplitude 
maneuvers  must  also  be  matched  against  test  data. 

The  target  of  the  final  model  should  also  be  considered  in  the  final  validation  plan.  An  aerodynamic  model, 
which  will  be  used  in  an  avionics  trainer,  may  not  require  the  fidelity  and  breadth  as  that  for  a  full 
engineering  level  simulator.  Many  models  for  different  purposes  may  be  generated;  the  engineering  team 
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must  decide  what  levels  of  validation  are  required  for  each  model,  and  then  design  the  validation  effort 
accordingly.  Both  the  validation  process  and  model  as  a  whole  must  be  thoroughly  documented.  The 
validity  range  of  the  model  must  be  presented  in  such  a  manner  that  future  users  will  know  how  far  the 
model  can  be  trusted.  As  an  example,  a  simple  transfer  function  model  of  the  roll  dynamics  of  an  aircraft 
must  not  be  used  to  predict  the  character  of  a  full  360-degree  roll  maneuver.  The  model  documentation 
must  contain  sufficient  information  so  that  the  user  will  not  have  to  assume  a  range  of  validity  and 
subsequently  inappropriately  apply  the  model. 

3.4  Configuration  for  DFCS  Flight  Testing 

3.4.1  General 

It  is  estimated  that  70  to  80  percent  of  future  flight  test  programs  will  involve  disciplines  other  than 
performance  and  flying  qualities.  Avionics,  communication  systems,  defensive  and  offensive  systems  and 
low  observability  will  constitute  the  bulk  of  the  test  program’s  schedule  and  budget.  However,  before  much 
of  this  can  occur,  the  basic  flight  envelope  must  be  cleared.  Any  delays  during  the  performance,  flying 
qualities  and  structures  testing  will  delay  the  entire  program.  Test  communities  have  developed  special  test 
configurations  over  the  years.  These  configurations  significantly  improve  both  the  efficiency  and  the  safety 
of  flight  testing  the  DFCS.  These  special  systems  configurations  allow  a  thorough  examination  of  the 
system  as  well  as  enhance  the  ability  to  apply  the  predict,  test,  update,  and  validate  philosophy.  This  section 
will  describe  some  of  these  special  test  configurations  as  they  apply  to  the  flight  testing  of  the  DFCS. 

One  of  the  most  difficult  jobs  of  the  DFCS  test  team  is  to  convince  program  management  of  the  need  for 
these  specially  designed  systems.  They  add  cost  and  schedule  up  front  in  the  design  process,  and  as  such 
program  management  is  often  reluctant  to  include  them  in  the  test  vehicle.  This  is  especially  true  in  today’s 
world  of  success-oriented  systems  test,  where  everything  is  expected  to  work  the  first  time.  When  the 
inevitable  occurs,  and  the  system  has  a  problem,  defining  and  correcting  the  problem  may  be  difficult.  The 
use  of  these  configurations  must  be  sold  to  program  management  on  a  risk  reduction  basis.  Having  these 
capabilities  reduces  the  risk  of  ‘show  stoppers’  occurring  and  minimizes  the  time  for  redesign  if  major 
anomalies  are  found  during  flight  test.  The  special  test  configurations  allow  the  test  team  to  understand  not 
only  what  the  system  is  doing,  but  also  why  it  is  occurring.  This  is  the  first  step  in  any  problem  resolution 
process.  These  configurations  help  to  minimize  or  reduce  risk  by  allowing  the  problem  resolution  process 
to  proceed  as  rapidly  as  possible  when  unexpected  anomalies  are  found  during  test.  The  new  emphasis  on 
using  modeling  and  simulation,  and  hence  the  predict,  test,  update,  validate  methodology,  will  aid  the 
DFCS  flight  test  team  in  convincing  management  that  the  addition  of  these  special  configurations  will  have 
a  financial  and  schedule  return  on  investment. 

3.4.2  Programmed  Test  Inputs 

The  programmed  test  input  (PTI)  allows  insertion  of  test  signals  at  specific  points  in  the  flight  control 
system.  Test  signals  are  usually  stored  in  the  DFCS  memory,  and  appropriate  paths  allowed  in  the  initial 
software  for  implementation.  The  PTI  is  designed  to  provide  a  given  set  of  information.  It  is  often  used  to 
define  aerodynamic,  FCS  functional  and  aeroservoelastic  characteristics.  Some  information  may  not  be 
obtainable  from  normal  system  operation  and  may  require  a  PTI  for  model  generation  or  validation.  For 
example,  the  current  practice  of  using  correlated  aileron  and  differential  horizontal  tail  to  provide  roll 
control  may  make  it  impossible  to  separate  the  aerodynamic  effects  of  each.  A  separate  surface  input  may 
be  required  to  identify  the  aerodynamics  of  both  the  aileron  and  the  differential  tail. 

Although  many  types  of  inputs  are  used,  they  are  usually  of  relatively  small  amplitude.  Inputs  such  as  small 
amplitude  doublets,  steps  and  frequency  sweeps  are  most  often  used.  Maneuver  duration  and  magnitude  are 
verified  in  the  simulation  and  tailored  for  the  configuration,  test  condition,  and  information  desired.  The 
PTI  also  requires  some  form  of  input  limiting  and  failure  checking.  The  systems  are  designed  to  disengage 
when  failures  are  detected  or  limits  exceeded.  The  system  must  also  contain  the  ability  to  be  engaged  and 
disengaged  by  the  pilot  or  a  ground  controller.  Careful  verification  of  the  implementation,  failure  and  limits 
monitoring,  and  input  type  must  be  carried  out  with  the  actual  software  in  a  bench  test  or  iron  bird 
implementation  prior  to  flight.  Errors  in  the  code  or  implementation  can  have  disastrous  effects. 
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3.4.3  In-Flight  Variable  Gain 

As  full  fly-by-wire  systems  have  become  more  prevalent  in  recent  years,  the  use  of  an  in-flight  variable 
gain  capability  has  proven  invaluable.  This  type  of  system  has  been  successfully  used  on  the  B-2,  C-17, 
F-16,  F-15E  and  YF-22  test  programs.  The  in-flight  variable  gain  allows  the  use  of  a  variable  set 
of  predetermined  gains  during  the  test  program.  All  systems  with  a  DFCS  will  experience  some  difficulty 
during  development  and  will  require,  as  a  minimum,  gain  modifications  during  the  flight  test  program. 
Software  modification,  verification,  and  validation  are  time-consuming  and  expensive  processes.  This 
time  can  be  minimized  by  using  multiple  gain  combinations  within  the  same  software  release.  The 
inclusion  of  an  in-flight  variable  gain  capability  will  reduce  the  need  for  expensive  and  time-consuming 
fly-fix-fly  methodology.  In  addition,  there  are  some  problem  occurrences  such  as  aeroservoelastic 
instability  or  large  amplitude  limit  cycle  where  flight  safety  may  require  a  rapid  reduction  in  gain  level. 
This  can  only  be  accomplished  with  in-flight  variable  gain  capability.  The  decision  to  use  variable  gain 
capability  must  be  made  early  in  the  design  portion  of  the  program,  since  the  ability  must  be  incorporated 
into  the  test  software. 

The  gains  to  be  varied  and  the  allowable  sets  of  variation  are  usually  determined  via  simulation 
and  parameter  variation  studies.  Potential  variation  sets  are  identified  and  included  in  the  basic  software. 
Careful  software  verification  as  well  as  the  predicted  flying  qualities  with  each  gain  set  must  be  studied 
prior  to  their  use  in  flight;  this  will  help  preclude  using  a  set  of  gains  which  are  unsafe.  It  is  often  difficult 
to  prejudge  the  desired  level  of  gain  variation  prior  to  knowing  the  actual  system  performance.  Parameter 
variation  studies  can  help  to  identify  candidate  gain  variations,  but  even  as  such,  they  may  not  be 
correct.  The  actual  gain  values  can  be  modified  during  planned  software  update  cycles  to  reflect  actual 
system  performance. 

One  of  the  past  objections  to  implementing  an  in-flight  gain  variation  process  has  been  that  the  final 
software,  without  the  gain  variation  path,  must  be  completely  retested  or  verified  before  final  production 
release,  thus  adding  expense  to  the  program.  Many  modern  test  programs  alleviate  this  concern  by  leaving 
the  gain  variation  capability  within  the  production  software,  but  deactivate  the  capability  in  the  final 
production  release.  This  philosophy  reduces  the  extent  of  the  retest  and  verification  process  and  also  makes 
it  much  easier  to  accomplish  future  upgrade  testing,  since  the  basic  capability  already  exists  in  the 
production  software  and  does  not  have  to  be  redesigned  in  for  future  upgrades.  Another  objection  concerns 
the  safety  issue  of  varying  the  gains  while  in  flight.  The  in-flight  variable  gain  capability  has  mainly  been 
used  in  the  United  States  to  date,  and  many  European  aviation  organizations  are  leery  of  its  use.  There  is 
the  potential  for  selecting  gains  which  could  cause  system  problems  or  instabilities.  Risk  can  be  minimized 
by  employing  a  carefully  designed  verification  and  prediction  process.  The  process  has  enjoyed  success 
with  many  test  programs  without  major  incident.  The  experience  to  date  has  been  that  the  benefits  out 
weigh  the  risks  if  the  methodology  is  properly  applied. 

3.4.4  In-Flight  Fault  Simulation  and  Clearing 

An  in-flight  fault  simulation  and  clearing  capability  makes  it  possible  to  evaluate  the  flying  qualities  of 
failure  states.  Implementing  simulated  failures  along  with  the  ability  to  quickly  clear  them  also  allows  final 
validation  of  the  redundancy  management  process.  As  in  other  in-flight  modifications  of  the  DFCS,  the 
type,  location,  and  capability  to  accomplish  clearance  must  be  carefully  verified  and  validated  prior  to  its 
actual  use  in  flight.  There  continues  to  be  much  disagreement  within  the  DFCS  test  community  as  to 
whether  it  is  wise  to  provide  this  type  of  capability  in  the  test  vehicle. 

Most  DFCS  allow  for  the  detection  and  isolation  of  failures,  as  well  as  providing  appropriate 
re-configuration  when  failures  degrade  system  performance.  Testing  of  failure  states  has  mostly  been  left  to 
simulation  in  the  past.  There  are  certainly  some  failures  for  which  it  is  too  dangerous  to  investigate  in 
flight,  and  these  will  require  verification  and  validation  via  simulation.  However,  the  situations  where  the 
flying  qualities  are  not  predicted  to  be  unsafe  can  be  verified  in  flight  using  this  capability.  This  is  most 
applicable  within  the  fail  operational  levels  of  fault  detection  or  with  outer  loop  systems  such  as  autopilots, 
which  can  be  quickly  disengaged.  In  addition,  it  is  likely  that  at  least  some  unintended  failures  will  be 
encountered  during  the  test  program.  Many  of  these  failures  are  momentary  problems,  which  may  have 
been  latched  or  locked  into  place  by  the  software.  The  fault  may  be  self-correcting,  but  the  aircraft  has  been 
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placed  in  a  reduced  state  of  safety  by  latching  the  failure  into  place  (i.e.,  a  sensor  is  still  declared  failed 
when  properly  operating  again).  If  this  is  the  case,  the  ability  to  clear  a  fault  may  succeed  in  placing  the 
aircraft  back  into  a  full  operational  status.  An  example  may  be  an  air-data  probe  failure  while  momentarily 
at  high  AOA  or  sideslip.  A  fault  may  have  been  declared  and  latched  and  the  backup  gains  invoked, 
however,  the  air  data  system  may  well  return  to  normal  operation  after  recovery  to  lower  AOA  or  sideslip. 
If  the  failure  has  been  latched,  the  system  may  remain  in  a  backup  gain  mode.  The  ability  to  clear  this  type 
of  fault  will  save  test  time  and  complications,  as  well  as  improve  test  safety. 

3.4.5  Instrumentation 

Perhaps  the  most  important  part  of  a  proper  configuration  for  flying  qualities  testing  is  the  instrumentation 
system.  The  DFCS  flight  test  team  must  be  actively  involved  early  in  defining  this  aspect  of  the 
configuration.  While  the  design  engineers  may  also  be  instrumental  in  defining  needed  parameters,  most 
have  little  or  no  knowledge  of  instrumentation  system  operation.  It  is  up  to  the  test  team  to  supply  this 
knowledge  to  ensure  that  not  only  the  appropriate  parameters  are  available,  but  also  that  the  quality  of  the 
instrumentation  is  satisfactory.  Unfortunately,  the  tendency  is  to  assume  that  if  a  parameter  is  instrumented, 
then  the  quality  is  sufficient  to  supply  the  needs.  This  is  far  from  the  truth.  The  quality  of  the 
instrumentation  can  make  or  break  the  use  of  a  predict  test,  update,  and  validate  test  philosophy.  The  ability 
to  apply  this  philosophy  is  only  as  good  as  the  instrumentation,  both  in  the  parameters  available  and  the 
quality  of  the  data. 

The  first  step  is  to  decide  which  parameters  should  be  instrumented.  These  need  to  include  internal  DFCS 
and  other  systems  parameters,  which  may  be  needed  to  quantify  the  system.  The  test  team  should  look  at 
the  intended  envelope  of  the  aircraft,  what  the  test  objectives  are,  what  level  of  model  updating  and 
validation  is  planned,  and  the  data  analysis  methods.  Current  instrumentation  systems  are  capable  of 
providing  a  large  number  of  parameters  at  significant  sample  rates.  However,  just  because  a  system  can  do 
something,  does  not  mean  that  it  should.  There  is  a  tendency  to  request  many  more  parameters  than  are 
needed.  This  not  only  adds  unnecessary  cost  to  the  program,  but  can  also  adversely  impact  the  truly  needed 
information.  The  DFCS  flight  test  team  should  judiciously  determine  the  required  information  for  the 
program,  and  resist  the  tendency  to  ask  for  more  than  they  need. 

The  next  decision  will  be  parameter  range  and  resolution.  Range  and  resolution  are  integral  parts  of  each 
other,  since  almost  all-modern  data  systems  will  eventually  undergo  digitization.  The  range  and  bit  level  of 
the  digital  words  will  determine  the  resolution.  The  range  must  be  carefully  considered,  and  appropriate 
values  selected  which  reflect  the  aircraft  performance  capability.  For  example,  it  makes  no  sense  for  the 
air-data  instrumentation  system  on  a  subsonic  transport  to  have  the  ability  to  read  Mach  numbers  up  to  2.0. 
Another  example  might  be  pitch  and  roll  rates,  where  a  transport  aircraft  would  not  be  expected  to 
experience  as  large  of  values  as  on  a  fighter.  The  resolution  will  be  determined  by  the  overall  range  and  the 
least  significant  bit  capability  of  the  digital  word.  Large  ranges,  combined  with  low  bit  length  words  will 
provide  poor  resolution.  As  a  rule,  the  minimum  word  length  for  most  flying  qualities  testing  should  be 
10  bits,  with  12  or  more  desired.  As  an  example,  the  resolution  with  a  10-bit-word  length  on  roll  attitude, 
with  a  360-degree  range  will  be  approximately  0.36  degrees.  The  following  formula  can  be  used  to 
determine  resolution  from  bit  length  and  range. 


Resolution  = 


Range 

2n 


(2) 


where: 


n  =  number  of  bits. 


17 


Resolution  should  not  be  confused  with  accuracy.  Just  because  the  resolution  of  a  measurement  is  known, 
the  same  level  of  accuracy  is  not  necessarily  present.  Resolution  only  gives  the  smallest  variation  the  sensor 
can  measure.  The  accuracy  of  the  measured  parameter  or  parameters  depends  on  several  other  factors, 
particularly  resolution,  calibration,  and  corrections.  As  an  example,  an  AOA  vane  may  have  a  resolution  to 
0.1  degree,  but  other  error  sources  in  the  measurement  (e.g.,  upwash,  rate  errors),  will  mean  that  the 
accuracy  is  much  less. 

Sensor  placement  should  also  be  considered.  Sensor  placement  can  be  critical,  but  is  primarily  a  matter  of 
available  locations  and  common  sense.  Using  a  noseboom  on  a  single  engine,  tractor  propeller-driven 
aircraft  will  not  be  possible  and  a  total  temperature  probe  in  the  exhaust  stream  of  the  engine  will  not 
provide  accurate  data  on  the  free  stream  air  temperature.  Space,  power  and  cooling  availability,  structural 
modes,  and  wiring  placement  will  all  play  a  role  in  where  sensors  can  be  placed.  The  DFCS  flight  test  team 
should  seek  to  ensure  that  within  bounds  of  practicality,  the  sensors  are  placed  as  close  as  possible  to  where 
accurate  data  can  be  measured. 

The  next  consideration  is  sample  rate.  Theoretically,  Nyquist  theory  states  that  a  minimum  sample  rate  of 
twice  the  highest  frequency  of  interest  is  required  to  identify  that  frequency.  In  practice,  the  rule  of  thumb 
is  a  sample  rate  4  to  5  times  the  highest  frequency  of  interest.  This  is  a  rule  of  thumb  and  not  always 
applicable.  For  example,  for  aerodynamic  parameter  identification,  where  frequencies  higher  than  5  Flz  are 
almost  never  encountered,  a  sampling  rate  minimum  of  at  least  40  samples  per  second  is  desired.  Lower 
rates  can  be  used  if  the  system  is  precisely  timed  and  noise  or  delays  are  minimal.  This  is  not  the  case  with 
most  data  systems.  For  most  flying  qualities  work,  the  key  parameters  should  be  sampled  at  a  minimum 
40  to  50  samples  per  second.  These  include  accelerations,  angular  rates,  attitude,  AOA,  sideslip,  and 
surface  and  pilot  inputs.  Airspeed,  altitude,  and  weight  measurements  can  be  taken  at  lower  rates,  but 
should  be  at  a  minimum  of  10  samples  per  second.  High  sample  rates  should  also  be  used  for  internal 
analog  signals  for  such  things  as  actuator  commands  and  hydraulic  pressures.  The  internal  DFCS 
parameters  should  be  minimally  at  the  rate  of  the  frame  time  for  the  computer,  although  a  higher  rate  may 
be  desirable  to  ensure  that  discretes  are  registered  accurately. 

Whenever  digitization  of  any  analog  signal  is  applied,  aliasing  must  be  considered.  Aliasing  is  a 
high-frequency  signal  that  appears  as  a  low-frequency  signal  when  digitization  is  applied.  All  analog 
signals  will  contain  frequencies  higher  than  those  required  for  the  basic  parameter  of  interest.  For  example, 
high-frequency  structural  modes  may  be  present  in  an  accelerometer  signal.  These  frequencies  may  be 
much  higher  than  the  desired  rigid-body  motion  being  analyzed.  If  appropriate  precautions  are  not  taken, 
these  frequencies  can  alias  and  appear  as  lower-frequency  rigid-body  motions.  Once  aliasing  occurs  in  a 
digital  signal,  there  is  no  recovery  unless  the  analog  signal  is  available.  Since  most  sensor  signals  are 
analog  prior  to  being  digitized,  the  solution  to  aliasing  is  to  low  pass  filter  the  analog  signal  prior  to 
digitization.  These  are  called  anti-aliasing  filters.  They  work  by  attenuating  higher  frequencies  in  the 
analog  signal  so  that  the  impact  of  aliasing  is  minimal.  Aliasing  cannot  be  prevented,  but  its  impact  can  be 
reduced  so  that  it  is  no  longer  a  factor.  Digital  filtering  after  digitization  will  not  remove  or  reduce  the 
impact  of  aliasing.  It  is  obvious  that  the  type  of  filter,  its  cutoff  frequency,  and  roll-off  characteristics  can 
have  a  profound  impact  on  the  quality  of  the  test  data  recorded.  The  DFCS  flight  test  team  should 
familiarize  themselves  with  the  basics  of  anti-aliasing  filter  design  and  implementation. 

Whenever  filters  are  used  on  any  signal,  phase  lags  are  invariably  imparted.  Relative  phase  lags  between 
signals  are  extremely  important,  particularly  when  performing  parameter  estimation.  Most  parameter 
estimation  techniques  use  the  relative  phasing  of  signals  for  the  identification  process.  Artificial  relative 
phasing  induced  by  using  mismatched  filters  on  signals  can  lead  to  misidentification  of  parameters.  For  this 
reason,  signals,  which  will  be  used  in  any  model  updating  or  parameter  identification  analysis,  should 
use  the  same  anti-aliasing  filters.  While  all  will  experience  phase  lags,  the  relative  phasing  will 
remain  unchanged. 

Another  factor  impacting  relative  phasing  is  time  delays.  A  pure  time  delay  will  lead  to  phase  lags;  the 
amount  of  phase  lag  is  proportional  to  the  frequency  for  a  given  time  delay.  Relative  time  delays  between 
signals  can  be  induced  with  the  practice  of  using  multiple  computers  to  shunt  signals  to  their  final 
destination,  the  data  recording  system.  Perhaps  the  worst  offender  in  introducing  relative  time  delays  is  the 
often  used  1553  data  bus.  The  data  are  placed  on  the  bus  in  an  asynchronous  manner,  and  there  is  usually 
no  way  of  telling  when  the  data  were  actually  sampled.  The  data  system  may  know  the  time  the  data  were 
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retrieved  from  the  data  bus  but  has  no  way  of  knowing  when  the  data  were  actually  sampled  and  placed  on 
the  data  bus.  The  asynchronous  nature  of  the  1553  bus  also  means  that  the  delay  will  not  be  consistent, 
hence  cannot  be  measured  on  the  ground  and  later  corrected.  Modern  practice  is  to  use  the  1553  or  similar 
data  bus  for  all  data  transporting.  This  can  impact  parameter  identification  and  model  updating.  The  DFCS 
test  team  should  try  to  ensure  that  parameters,  which  would  be  used  in  the  model  updating,  would  not  be 
obtained  over  a  1553  data  bus.  However,  this  is  not  always  practical  since  almost  all  modern  data  systems 
use  the  1553  data  bus  architecture.  In  this  case,  having  high  sample  rate  or  time  tagged  data  may  reduce  the 
relative  time  delay  impacts  between  signals. 

3.5  Ground  Testing 

3.5.1  Background 

Ground  testing  covers  a  broad  range  of  tests  and  analyses  in  order  to  provide  information  to  enable  system 
design  and  the  verification  and  validation  of  system  operation  prior  to  flight.  Ground  testing  experts 
primarily  conduct  many  of  these  tests,  such  as  wind-tunnel  or  ground-vibration  testing  (GVT).  However, 
the  DFCS  test  team  can  add  either  personal  or  corporate  experience  to  the  process  in  order  to  aid  in  the 
design  of  the  tests.  Past  experience  on  problems  encountered  with  mispredicted  models  can  be  extremely 
beneficial  to  the  professionals  involved  in  these  areas.  There  are  other  tests  such  as  aeroservoelasticity 
(ASE)  or  rigid  body  limit  cycles  where  the  DFCS  flight  test  team  may  become  personally  involved  in  the 
conduct  and  data  analyses.  Proper  ground  testing  is  essential  in  helping  to  ensure  the  success  of  the  flight 
test  program. 

3.5.2  Verification  and  Validation  Testing 

Verification  testing  is  the  process  of  determining  if  the  system  is  designed  as  specified;  does  the  software  or 
hardware  perform  as  specified?  Validation  testing  is  the  process  of  determining  if  the  system,  as  specified, 
will  perform  the  intended  task.  A  system  can  be  verified,  but  the  overall  performance  will  not  satisfy  the 
requirements.  That  is,  systems  can  be  verified  and  all  systems  perform  as  specified,  but  still  not  be 
validated.  The  distinction  is  not  always  obvious,  but  a  loose  analogy  might  be  that  all  the  subsystem 
components  operate  as  designed,  but  when  combined  into  an  entire  system,  they  do  not  perform  the 
intended  task. 

Figure  2  shows  a  simplified  block  diagram  of  the  DFCS  verification  and  validation  (V&V)  process. 
Validation  and  verification  are  performed  on  both  the  software  and  hardware.  Testing  usually  begins  at  a 
subcomponent  level,  and  then  proceeds  to  the  combined  systems  level  in  steps.  Each  subcomponent,  such 
as  actuators,  hydraulic  pumps,  software  modules,  is  individually  tested  to  ensure  that  they  are  performing 
as  specified,  then  systems  are  combined  to  ensure  that  they  work  together  to  provide  the  desired 
performance.  Software  testing  is  particularly  complex,  and  often  takes  up  the  majority  of  the  V&V  time. 
For  this  reason,  much  of  the  module  level  and  even  combined  level  of  software  verification  testing  is 
currently  automated.  Software  V&V  is  an  area  that  will  impact  the  DFCS  test  program  throughout  the 
development  cycle.  Extensive  software  V&V  may  be  required  for  even  small  software  changes  to  ensure 
that  the  signal  or  information  flows  have  not  been  altered. 
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Figure  2  Simplified  Digital  Flight  Control  System  Ground  Test  Verification  and  Validation  Process 
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3.5.3  Wind-Tunnel  Testing  and  Aerodynamic  Modeling 

Perhaps  the  earliest  and  most  invisible  ground  testing  to  the  DFCS  flight  test  team  are  the  wind-tunnel  tests. 
Wind-tunnel  testing  is  normally  perceived  as  the  province  of  the  aerodynamacists  and  wind-tunnel  testing 
experts.  However,  errors  in  the  wind-tunnel  data  or  development  of  the  aerodynamic  model  from  these  data 
tend  to  cause  the  DFCS  flight  test  team  some  of  the  most  common  and  troubling  problems  during  the  flight 
test  program.  The  most  valuable  contribution  the  DFCS  flight  test  team  can  make  to  these  efforts  is 
historical  information  from  past  programs  relative  to  troubles  encountered.  Data  on  specific  wind  tunnels 
and  their  known  error  sources,  data  on  where  past  aircraft  have  had  difficulty  in  predicting  the 
aerodynamics,  and  known  past  modeling  errors,  can  be  invaluable  to  the  developers  of  the  wind-tunnel  tests 
and  aerodynamic  models.  This  knowledge  is  often  available  either  from  personal  experience  of  the  DFCS 
flight  test  team,  or  within  other  areas  of  the  flight  test  organization 

The  DFCS  flight  test  team  should  make  themselves  familiar  with  the  types  of  tunnels  used,  the  techniques 
employed  and  where  the  data  from  these  tests  are  applicable.  They  should  also  become  familiar  with  what 
tests  were  run,  the  model  configurations,  and  the  basic  test  matrices.  If  involved  early,  the  DFCS  flight  test 
team  should  review  the  planned  tests  for  completeness.  The  wind-tunnel  testing  should  cover  not  only  the 
operational  envelope,  but  also  the  planned  test  envelope.  For  example,  if  spin  flight  testing  is  planned,  and 
the  wind-tunnel  testing  does  not  include  rotary  balance  data,  the  test  team  should  suggest  that  this  type  of 
testing  be  conducted. 

The  DFCS  flight  test  team  should  also  become  familiar  with  the  process  being  used  to  generate 
an  aerodynamic  model  from  the  wind-tunnel  data.  Today’s  aircraft  usually  undergo  thousands  of  hours 
of  wind-tunnel  testing  to  define  the  final  configuration.  The  volume  of  data  alone  makes  it  impossible 
to  simply  lump  all  of  the  wind-tunnel  information  into  a  large  table  lookup  model.  In  addition,  much  of 
the  data  may  be  for  preliminary  configurations,  with  subsequent  wind  tunnel  runs  used  to  define  changes 
based  on  configuration  updates.  It  is  usually  up  to  the  aerodynamacist  to  combine  all  the  data  into  a  usable 
aerodynamic  model.  This  is  a  job  that  requires  experience  and  judgment  and  hence  is  prone  to 
adding  human  modeling  errors  to  the  errors  in  the  wind-tunnel  data  itself.  The  adequacy  of  the  wind-tunnel 
testing  and  the  aerodynamic  modeling  will  be  the  cornerstone  of  the  DFCS  design  and  test  effort. 
Inadequate  wind-tunnel  testing  and  modeling  will  increase  the  uncertainty  in  the  system,  and  most  likely 
lead  to  design  and  flight  test  problems. 

3.5.4  Initial  Piloted  Simulation 

Once  a  reasonable  aerodynamic  model  is  available,  the  initial  control  law  design  can  progress.  Once  an 
initial  control  law  design  is  available,  a  simulation  can  be  constructed  to  evaluate  the  effectiveness  of  the 
design.  This  will  range  from  small  amplitude  linear  simulations  to  more  complex  six-DOF,  nonlinear 
simulations.  The  initial  control  laws  are  usually  digitally  modeled  in  an  interim  language  such  as 
FORTRAN  or  C,  along  with  models  for  the  aerodynamics,  mass  properties,  actuation  systems,  and  sensors. 
Modifications  are  based  on  simulation  results  then  progress  until  a  final  control  law  configuration  is 
defined.  Simulations  (linear,  reduced  DOF  and  6-DOF  nonlinear)  are  integral  to  the  design  process  for  a 
DFCS. 

Once  a  DFCS  configuration  is  available,  more  complete  testing  for  flying  qualities  is  conducted  with  a 
piloted,  6-DOF  simulation.  This  testing  will  cover  the  entire  envelope  and  encompass  stability,  control,  and 
handling  qualities.  The  goal  is  a  final  verification  that  the  proposed  control  laws  will  meet  the 
specifications.  At  this  point,  models  for  the  RM  and  other  system  digital  models  may  or  may  not  have  been 
added  to  the  simulation.  If  the  RM  system  is  modeled,  failure  mode  testing  may  begin  at  this  point  as  well. 
There  is  a  tendency  to  fine-tune  the  system  as  the  piloted  simulation  testing  nears  its  final  stages.  This  may 
or  may  not  be  a  problem,  depending  on  the  type  of  simulation  and  the  fine-tuning  being  accomplished.  Pilot 
opinion  is  critical  in  defining  the  final  control  law  configuration,  but  this  opinion  can  also  be  in  error.  As  an 
example,  it  is  common  for  pilots  to  think  that  the  aircraft  is  sluggish  based  on  fixed-base  simulation  results. 
Fine-tuning  so  that  the  pilot  now  feels  the  system  responds  ‘just  right'  may  well  result  in  a  design  that  is 
overly  sensitive  in  flight.  The  fixed-base  simulation  does  not  provide  the  pilot  with  the  seat-of-the-pants 
cues  for  maneuvering  (as  will  occur  in  flight),  hence  the  initial  perception  of  sluggishness  based  on 
fixed-based  simulation  may  be  incorrect.  The  use  of  a  motion-based  simulation  is  controversial  in  solving 
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this  problem.  Limitations  of  motion-based  simulations  mean  that  they  cannot  duplicate  the  aircraft  motions 
with  a  high  degree  of  fidelity.  They  may  provide  motion  cues,  but  the  results  based  on  these  cues  can  be  as 
much  in  error  as  using  the  fixed-based  simulator. 

Another  controversial  subject  for  this  level  of  evaluation  is  handling  qualities.  Because  of  the  limitations  of 
ground-based  simulation,  it  has  long  been  held  that  handling  qualities  evaluations  for  problems  such  as  PIO 
or  poor  task  accomplishment  cannot  be  accomplished  on  the  simulator,  and  especially  not  on  a  fixed-base 
simulator.  The  limitations  of  ground-based  simulation,  motion  infidelity,  time  delays,  and  lack  of  visual 
acuity  have  long  been  thought  to  preclude  ground-based  simulation  use  in  handling  qualities  studies.  While 
detailed  handling  qualities  and  fine  tuning  may  not  be  possible,  it  has  been  the  experience  at  the  Air  Force 
Flight  Test  Center  (AFFTC)  that  major  handling  qualities  problems  such  as  severe  PIO  can  often  be 
detected  on  fixed-based  simulation  using  simple  visual  displays.  The  key  to  success  is  to  eliminate  motion, 
minimize  visual-time  delays  and  conduct  a  sufficiently  high-gain  task.  High  fidelity  visual  scenes  are  often 
reduced  to  simple  stick  diagrams  mimicking  an  attitude  directional  indicator  (ADI)  in  order  to  reduce  visual 
time  delays.  A  high-gain,  zero  error,  random  tracking  task  such  as  handling  qualities  during  tracking 
(HQDT)  ( System  Identification  Form  Tracking,  Reference  2)  is  performed  to  search  for  major  problems 
such  as  PIO.  This  is  a  specific  task  as  outlined  in  Reference  2  and  is  different  from  normal  operational-type 
tracking.  While  techniques  such  as  these  may  reveal  severe  handling  qualities  problems,  the  overall  lack  of 
ground-based  simulation  fidelity  also  makes  fine-tuning  of  handling  qualities  questionable.  Trying  to  go 
from  a  Cooper  Harper  Rating  (Reference  3)  of  2  to  a  1  is  probably  not  within  the  fidelity  of  the  simulation. 
However,  going  from  a  7  to  a  3  may  be  possible  if  the  tasks  are  properly  designed. 

An  important  study,  which  is  appropriate  at  this  stage,  is  aerodynamic  parameter  variation  evaluations.  This 
study  is  often  planned,  but  quickly  goes  by  the  wayside  as  programmatic  pressures  build.  As  previously 
discussed,  the  aerodynamic  model  is  an  area  of  relatively  high  uncertainty,  and  is  a  key  component  to  any 
DFCS  control  law  design  effort.  Most  systems  are  designed  to  be  robust;  however,  classical  measures  of 
robustness  such  as  gain  and  phase  margin  do  not  necessarily  give  sufficient  insight  neither  into  nonlinear 
behavior  nor  to  the  flying  qualities  of  an  aircraft.  It  is  advisable  to  vary  the  key  aerodynamic  parameters 
from  25  to  50  percent,  in  a  worst  case  direction,  and  then  re-evaluate  the  flying  qualities  with  piloted 
simulation. 

3.5.5  Module  and  Integrated  Software  Level  Testing 

Once  the  final  system  design  has  been  established,  the  process  of  coding  the  final  system  software  begins. 
Verification  testing  of  the  software  operability  is  one  of  the  most  time-consuming  and  expensive  processes 
in  the  design  cycle.  Many  tests  must  be  repeated  any  time  that  software  is  updated.  While  testing  may  begin 
early  in  the  design  process,  verification  must  be  conducted  with  the  final  design  intended  for  flight.  The 
software  verification  process  is  designed  to  verify  that  the  software  is  working  according  to  specification. 
Code  for  most  modern  DFCS  systems  can  run  into  hundreds  of  thousands  of  lines,  and  the  complexity 
increases  as  more  and  more  integrated  systems  are  being  designed.  As  code  complexity  increases,  so  does 
the  software  verification  task. 

Most  control  system  software  is  modularized  to  make  integration  and  modification  easier.  To  ensure  the 
correct  operation  of  each  module,  verification  testing  is  conducted.  This  testing  is  often  automated,  with 
preprogram  inputs  to  the  module  designed  to  verify  all  input  and  output  paths,  as  well  as  internal  module 
paths.  Once  the  module  level  testing  has  been  accomplished,  the  modules  are  assembled  to  perform  higher 
level  functions,  and  the  detailed  testing  is  repeated.  The  modules  are  then  assembled  and  compiled  into  the 
target  flight  control  computer  (FCC)  and  verification  testing  is  repeated. 
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3.5.6  Hardware-In-The-Loop  Simulator 

The  hardware-in-the-loop  (HITL)  simulator  is  a  hybrid  simulator,  which  at  its  simplest  level  contains  the 
DFCS  and  other  computer  hardware  with  the  associated  software.  The  simple  level  HITL  simulator  usually 
does  not  contain  hydraulic,  electrical  or  actuation  systems.  The  purpose  of  this  level  of  HITL  is  to  verify 
that  the  software  implementation  acts  as  designed  within  the  actual  FCC  hardware.  The  control  laws  and 
commands  are  generated  via  the  actual  FCC;  the  input  signals,  actuation  commands,  and  resulting  aircraft 
motion  are  generated  via  digital  simulation. 

3.5.7  Iron  Bird 

The  Iron  Bird  is  a  higher  level  HITL  simulation  where  all  the  flight  control  hardware  and  software  are 
integrated  with  the  actuation,  hydraulic  and  electrical  power  systems,  and  sensors.  The  6-DOF  dynamics 
are  simulated  via  digital  simulation.  The  systems  are  duplicated  exactly  as  they  will  appear  on  the  aircraft. 
The  simulator  should  also  model  the  mass  properties  (e.g.,  weight,  eg,  and  inertias)  of  the  control  surfaces. 
The  Iron  Bird  should  contain  all  of  the  mechanical  and  electrical  nonlinearities  as  the  full  aircraft  systems. 
The  system  should  be  capable  of  simulating  the  rigid-body  dynamics  and  resultant  hardware  and  software 
response  as  close  to  that  of  the  actual  aircraft  as  possible.  Sensor  inputs  and  dynamics  are  usually  simulated 
either  digitally  or  in  analog  form. 

The  Iron  Bird  simulation  is  used  to  verify  and  validate  the  rigid-body,  total-system  models  and  design.  At 
this  stage,  the  system  will  be  well  enough  defined  to  allow  both  verification  and  validation  testing. 
Extensive  software,  logic,  static  and  dynamic  verification  testing  will  be  conducted  on  the  integrated  flight 
control,  hydraulic,  and  electrical  systems.  Validation  testing  on  actuator,  hydraulics,  and  electrical  system 
components  will  also  be  accomplished.  The  Iron  Bird  is  as  close  a  simulation  as  is  possible  of  the  aircraft 
systems  and  subsystems  as  can  be  accomplished  prior  to  having  an  actual  aircraft. 

Most  modem  military  and  commercial  aircraft  programs  will  have  an  Iron  Bird  available  for  not  only  the 
initial  development  testing,  but  often  well  into  the  life  cycle  of  the  aircraft.  During  the  life  of  an  aircraft, 
many  software  and  hardware  upgrades  and  modifications  can  be  expected,  which  will  require  the  use  of  an 
Iron  Bird.  However,  many  small  programs,  or  upgrades  on  older  aircraft,  may  not  have  the  benefit  of  an 
Iron  Bird  simulator.  It  may  be  necessary  to  conduct  the  tests  with  the  actual  aircraft.  There  are  advantages 
and  disadvantages  to  this  process.  The  advantage  is  that  you  are  working  with  the  actual  hardware,  and  not 
a  simulation.  This  will  increase  the  confidence  level  in  the  results.  The  disadvantage  is  that  the  aircraft  can 
be  damaged  if  instabilities  are  encountered  during  the  tests.  For  this  reason,  a  kill  switch  which  will  rapidly 
cutoff  hydraulic  or  electrical  power  is  a  requirement  for  on-aircraft  tests.  Another  disadvantage  of  on- 
aircraft  tests  is  the  necessity  to  use  a  hydraulic  and  electrical  cart  to  provide  hydraulic  and  electrical  power 
to  the  aircraft.  These  carts  seldom  have  the  full  hydraulic  flow  capacity  of  the  real  aircraft  system.  Data  on 
the  nonlinear  characteristics,  such  as  surface  rate  limits  where  hydraulic  flow  capacity  is  critical,  may  not 
be  valid  for  tests  using  a  cart  as  a  power  source. 

3.5.8  Ground  Vibration  Tests 

The  ground  vibration  tests  (GVTs)  are  performed  by  the  structural  dynamics  engineers  to  validate  the 
analytic  structural  models  used  in  the  design.  Special  excitation  devices  are  used  to  vibrate  the  aircraft 
structure  at  frequencies  which  span  the  spectrum  of  the  predicted  modes.  An  array  of  accelerometers 
attached  to  the  surface  of  the  aircraft  measure  the  response  to  a  known  input.  The  structural  dynamics 
engineers  can  then  experimentally  determine  the  frequency,  amplitude  and  mode  shapes  for  the  structure. 
The  GVT  results  are  used  to  update  the  predicted  structural  models  of  the  aircraft. 

The  GVT  results  are  more  accurate  than  analytically  predicted  characteristics,  but  also  have  some  level  of 
uncertainty.  One  source  of  uncertainty  is  the  type  of  ground  support  system.  The  manner  in  which  the 
aircraft  is  structurally  supported  can  impact  the  results  of  these  tests.  If  the  aircraft  is  sitting  on  the  landing 
gear,  the  measured  modes  may  be  impacted  by  the  dynamics  imparted  by  the  gear  and  interaction  with  the 
ground.  Several  solutions  to  this  problem  have  been  used  in  the  past.  These  range  from  deflating  the 
landing  gear  struts  and  tires  to  using  complex  and  expensive  soft  support  systems.  Determining  the  ground 
support  requirements  is  a  complex  subject,  which  will  be  decided  by  the  structural  dynamics  experts. 
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The  DFCS  flight  test  team  may  or  may  not  be  directly  involved  with  the  GVT.  However,  if  not  involved, 
they  should  be  aware  of  the  results,  and  whether  or  not  the  results  validate  the  analytic  models.  Closed-loop 
flight  control  systems  can  interact  with  the  structural  modes  and  cause  instabilities.  If  the  test  results  are 
significantly  different  than  those  predicted  by  the  analytic  models,  than  serious  flight  control  problems 
could  occur. 

3.5.9  Closed-  and  Open-Loop  Structural  Resonance  and  Stability  Margins 

Closed-loop  flight  control  systems  can  couple  with  the  structural  dynamics  and  cause  severe  instability. 
Structural  coupling,  or  resonance,  can  cause  catastrophic  failure  and  loss  of  the  aircraft.  Structural 
resonance  tests  are  conducted  to  validate  the  analytic  models  for  the  final  closed-loop  system.  Stability 
margins  are  measured  to  ensure  that  coupling  has  been  sufficiently  suppressed  or  does  not  occur.  For  most 
of  the  history  of  the  DFCS,  structural  coupling  has  been  primarily  a  concern  in  frequency  ranges  outside  of 
the  rigid-body  dynamics  (i.e.,  modes  greater  than  4-5  Hertz).  This  allowed  the  structural  resonance  ground 
tests  to  be  conducted  without  accounting  for  the  rigid  body  aerodynamics;  hence,  the  tests  could  be 
performed  without  the  need  for  inclusion  of  these  dynamics  in  the  loop  via  digital  simulation.  It  was 
possible  to  separate  the  structural  coupling  tests  at  high  frequencies  and  the  lower  frequency  tests  for 
rigid-body  limit  cycle,  which  will  be  discussed  later.  This  situation  is  still  true  for  many  structurally  stiff 
fighter-type  aircraft,  but  may  not  be  true  for  larger  transports,  which  tend  to  have  lower  structural 
frequencies.  This  may  change  for  fighters  as  active  structural  control  is  used  instead  of  the  heavier 
structural  stiffness  to  control  loads  and  dynamic  modes. 

Until  recently,  notch  filters  on  the  sensor  inputs  were  the  primary  tools  for  ensuring  that  structural  modes 
did  not  couple  with  the  DFCS.  Structural  mode  motions  picked  up  by  the  DFCS  sensors  were  reduced  or 
eliminated  with  notch  filters,  which  removed  the  structural  component  from  the  signal.  This  method  is 
called  gain  stabilization,  where  the  highest  structural  peak  in  an  open-loop  frequency  response  was  at  least 
6  to  8  Decibels  (dB)  below  zero  dB  (dB  is  defined  as  20*Log10[output/input]).  Linear  analysis  theory  states 
that  the  boundary  for  stability  is  where  the  gain  is  at  zero  dB  and  the  phase  is  +180  degrees.  The  notch 
filters  attenuate  the  structural  component  of  the  feedback  signal  to  ensure  that  the  gain  at  the  structural 
frequencies  of  concern  was  at  least  6  to  8  dB  away  from  instability.  This  method  has  worked  well  with 
structurally  stiff  fighter  aircraft,  which  were  the  primary  users  of  the  DFCS  for  many  years.  The  structural 
stiffness  ensured  that  the  modes  were  of  sufficiently  high  frequency  so  that  deletion  from  the  feedback  loop 
would  not  impact  the  rigid  body  flying  qualities.  However,  full  fly-by-wire  DFCS  is  now  being  used  on 
larger  aircraft.  These  aircraft  typically  can  have  structural  modes  which  are  at  low  enough  frequencies  to 
limit  the  use  of  notch  filtering  across  the  frequency  spectrum.  Notch  filters  can  be  used  for  the  higher 
frequency  modes,  but  the  low  frequency  modes  may  be  well  within  the  rigid  body  flying  qualities 
frequency  range,  precluding  the  use  of  notch  filters.  When  this  occurs,  extreme  care  must  be  taken  in  the 
DFCS  design  to  ensure  that  a  coupling  instability  does  not  occur.  This  can  be  accomplished  by  ensuring  the 
system  loop  gain  remains  relatively  low,  and  in  conjunction  with  a  methodology  called  phase  stabilization. 
In  phase  stabilization,  the  system  is  stabilized  by  using  appropriate  filters  to  shift  the  phase  curve  away 
from  the  +  180-degree  point  to  ensure  that  instability  does  not  occur. 

Structural  resonance  testing  is  often  referred  to  as  ASE  testing.  This  is  not  strictly  true  since  the 
aerodynamics  are  not  always  considered,  making  the  structural  resonance  servo-elastic,  as  opposed  to 
aeroservo  elastic  tests.  The  aerodynamics  come  into  play  in  two  areas,  the  rigid  body  aerodynamics  which 
are  usually  considered  for  frequencies  below  4  to  5  Hz,  and  the  unsteady  aerodynamics  associated  with 
flutter,  which  come  into  play  above  approximately  3  Hz.  The  unsteady  aerodynamics  are  difficult  to  predict 
and  model,  and  are  therefore  difficult  to  add  to  any  digital  simulation  for  full  ASE  testing.  Experience  has 
also  shown  that  the  unsteady  aerodynamics  tend  to  add  damping  to  the  system,  and  therefore,  neglecting 
these  during  the  ground  structural  resonance  testing  will  usually  give  conservative  results.  For  these 
reasons,  if  the  structural  modes  of  interest  are  of  sufficiently  high  frequency,  aerodynamics  is  often  not 
included  during  the  structural  resonance  tests. 

Figure  3  shows  the  schematic  for  the  open-loop  structural  resonance  tests.  The  system  is  first  tested  open 
loop  as  a  buildup  to  minimize  encountering  a  potentially  damaging  closed-loop  resonance.  For  these  tests,  a 
sin  wave  frequency  sweep  is  input  at  the  sensor  location,  and  the  response  is  measured  at  an  output.  This  is 
done  a  single  loop  at  a  time,  often  with  other  loops  remaining  closed.  Care  must  be  taken  to  ensure  that 
instabilities  do  not  occur  in  the  closed  loops.  Determining  the  correct  input  and  output  sources  to  define  the 


23 


true  open-loop  characteristics  depends  on  the  system.  Special  test  versions  of  the  DFCS  control  laws  may 
be  used  to  allow  loop  opening  within  the  control  laws  themselves,  or  if  this  is  not  available,  then  other 
input/output  points  such  as  at  the  actuator  command  junction  may  be  used.  The  frequency  sweeps  start  at 
low  magnitude,  and  then  are  run  with  increasing  magnitude  to  check  the  impact  of  nonlinearities  on  the 
response.  The  input  and  output  signal  are  analyzed  with  a  Fast  Fourier  Transform  (FFT)  algorithm  to  obtain 
the  spectral  characteristics  and  Bode  or  Nyquist  plots.  Actual  gain  and  phase  margins  can  then  be  measured 
from  these  plots. 


Sin  Sweep  Input 


Airframe  Response 
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Figure  3  Open-Loop  Structural  Resonance  Schematic 

Closed-loop  tests  are  conducted  after  the  open-loop  tests  show  sufficient  margins.  Figure  4  shows  a 
schematic  for  the  closed-loop  tests.  For  these  tests,  the  loop  is  closed,  and  the  structure  is  excited  with  high 
frequency  inputs.  The  response  is  monitored  to  ensure  that  an  unsafe  resonance  does  not  occur.  For  these 
tests,  the  loop  gain  is  incrementally  increased  to  a  magnitude  6  to  8  dB  above  nominal  to  ensure  that 
resonance  does  not  occur.  This  gives  the  final  validation  that  sufficient  margins  are  present  in  the  system. 

For  both  the  closed-  and  open-loop  resonance  tests,  the  DFCS  configuration  is  important.  The  DFCS  must 
be  configured  to  ensure  that  the  gains  being  selected  are  representative  of  the  intended  flight  condition. 
This  may  require  that  special  test  equipment  to  provide  appropriate  air  data  inputs  (airspeed,  Mach  number, 
altitude,  AOA,  etc.,)  such  that  appropriate  gains  and  logic  paths  are  used.  Gain  combinations  are  important, 
the  DFCS  flight  test  team  should  ensure  that  the  areas  of  highest  loop  gain  in  terms  of  airspeed,  altitude, 
and  AOA  have  been  covered  during  the  tests. 


Figure  4  Closed-Loop  Test  Schematic 
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3.5.10  Rigid  Body  Limit  Cycle 

The  purpose  of  the  rigid  body  limit  cycle  tests  is  to  evaluate  the  impact  of  control  system  nonlinearities 
such  as  hysterisis  and  dead  bands  on  the  system  gain  margins.  Nonlinearities  are  present  in  all  control 
systems,  although  careful  design  has  attempted  to  minimize  their  impact.  As  previously  discussed, 
the  unsteady  aerodynamics  are  not  included  due  to  prediction  and  modeling  difficulties;  however,  the 
rigid-body  aerodynamics  are  included  in  the  loop.  Rigid  body  limit  cycle  is  usually  concerned  with 
frequencies  of  3  Hz  or  less,  hence  the  importance  of  not  including  unsteady  aerodynamics  will  be  reduced 
but  not  eliminated.  There  will  still  be  uncertainty  in  both  the  predicted  rigid-body  aerodynamics  as  well 
as  the  impact  of  unsteady  aerodynamics. 

Figure  5  shows  a  typical  test  set-up  for  rigid  body  limit  cycle  testing.  The  sensors,  aerodynamics  and 
aircraft  response  is  computed  via  digital  or  analog  simulation.  Removing  the  sensors  from  the  loop 
essentially  removes  the  structural  aeroelastic  coupling  response  from  the  test.  The  tests  are  usually 
conducted  with  the  aircraft  resting  on  the  gear,  and  appropriate  measures  taken  such  as  deflating  the  tires 
and  struts.  However,  the  tests  can  also  be  run  in  conjunction  with  the  structural  coupling  tests  if  provisions 
are  made  to  include  the  required  simulation  and  connections.  This  method  is  increasingly  used  with  the 
sophisticated  simulation  capability  available  today. 
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Figure  5  Rigid  Body  Limit  Cycle  Schematic 

Rigid  body  limit  cycles  tests  are  accomplished  with  an  increasing  gain  method.  The  loop  gain  is 
incrementally  increased  until  small  amplitude  oscillations  occur,  or  an  increase  of  8  dB  without  sustained 
oscillation  has  occurred.  Because  rigid  body  limit  cycle  can  cause  structural  damage  if  the  amplitude  is 
allowed  to  get  too  high,  a  hydraulic  kill  switch  should  always  be  available.  Likewise,  careful  prediction 
from  digital  models  including  all  known  nonlinearities  as  well  as  test  data  from  the  Iron  Bird  should  be 
used  to  define  the  test  matrix.  Small  gain  increments  should  be  used  when  approaching  regions  of  predicted 
limit  cycle  to  minimize  the  possibility  of  large  amplitude  or  divergent  limit  cycle. 

Since  limit  cycle  is  a  nonlinear  phenomenon,  linear  analyses  will  not  necessarily  predict  the  proper 
margins.  Designers  typically  try  to  minimize  the  nonlinearities  present  in  any  system,  but  elimination  of 
these  nonlinearities  is  impossible.  All  mechanical  systems  will  experience  some  degree  of  dead-hands, 
hysterisis,  and  freeplay.  In  some  cases,  the  specific  use  of  nonlinearities  is  beneficial  to  the  FCS 
performance  and  intentionally  designed  into  the  system.  In  general,  the  nonlinear  gain  margins  will  be 
lower  than  the  analytical  linear  margins;  hence,  limit  cycle  may  be  encountered  at  a  gain  increase  less  than 
that  indicated  by  linear  analysis.  Limit  cycle  is  a  function  of  the  total  loop  gain,  which  includes 
aerodynamics  as  well  as  FCS  scheduled  gains.  The  test  conditions  for  the  rigid  body  limit  cycle  need  to 
reflect  regions  of  the  maximum  loop  gain  considering  both  the  DFCS  scheduled  gains  and  the  aerodynamic 
contributions,  which  are  proportional  to  dynamic  pressure.  The  FCS  usually  decreases  gains  with  dynamic 
pressure  to  offset  this  increase  in  the  aerodynamic  gain;  however,  this  is  not  always  the  case.  Fixed  gain 
systems  or  systems  where  other  factors  change  the  loop  gain  (e.g.,  AOA)  can  result  in  increasing  the 
overall  loop  gain  with  dynamic  pressure. 
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3.5.11  Electromagnetic  Compatibility 

Electromagnetic  interference  (EMI)  represents  a  serious  problem  for  an  electronic  flight  control  system 
since  it  provides  a  mechanism  for  potential  common  mode  failures  in  a  multiredundant  DFCS. 
Malfunctions  caused  by  EMI  can  range  between  being  insignificant  in  nature  to  causing  catastrophic 
failures.  Electromagnetic  interference  can  be  both  internally  and  externally  sourced  and  the  DFCS  design 
process  must  address  these  issues.  The  FCCs,  control  surface  actuators,  and  sensor  units  (inertial,  air  data,) 
as  well  as  all  pilot  inceptors,  switches,  and  all  data-bus  inputs  and  wiring  associated  with  the  FCS  must  be 
designed  to  be  resistant  to  all  forms  of  EMI.  This  will  include  radio  frequency  (RF),  microwave,  lightning 
and  electromagnetic  pulse  (EMP)  sourced  interference  as  well  as  any  perceived  future  EMI  threats. 

Before  the  aircraft’s  first  flight  is  flown,  sufficient  electromagnetic  compatibility  (EMC)  testing  must  be 
performed  on  the  complete  aircraft  to  ensure  that  the  aircraft  is  safe  to  fly  in  the  local  electromagnetic 
environment.  As  the  test  program  continues,  EMC  testing  to  clear  the  aircraft  to  the  full  electromagnetic 
threat  levels  in  the  production  configuration  must  be  performed 

The  EMC  ground  test  program  must  be  an  integrated  part  of  the  overall  EMC  test  philosophy  for 
the  aircraft  and  its  equipment  since  the  aircraft  test  results  will  be  used,  along  with  the  equipment 
test  results,  to  demonstrate  adequate  margins  from  malfunction.  When  defining  the  aircraft  test  program,  it 
must  be  ensured  that  the  aircraft  and  its  systems  are  in  a  representative  condition  for  each  phase  of  the 
EMC  test  program.  In  particular,  the  aircraft  must  be  in  a  fully  flight  representative  condition  for  the  final 
phases  of  on-aircraft  EMC  testing.  This  will  ensure  that  the  test  results  are  valid  and  realistic  flight 
clearances  can  be  generated. 

There  is  a  variety  of  EMC  test  techniques  currently  used  on  aircraft  with  a  DFCS.  Initial  on-aircraft  testing 
will  commence  with  the  aircraft  in  an  unpowered  condition  and  either  single-loom  or  multiloom  bulk 
current  injection  tests  may  be  performed.  External  antenna  can  also  be  used  to  radiate  the  aircraft  at 
a  number  of  different  aircraft  orientations  and  over  a  range  of  frequencies  and  transmitter  characteristics 
(e.g.,  horizontally  or  vertically  polarized).  Measurements  are  taken  at  the  FCS  equipment  to  determine  the 
level  of  current  induced  per  unit  of  field  strength.  These  results  can  then  be  compared  with  the  results 
of  the  equipment  bench  tests.  Testing  will  then  progress  to  the  powered  aircraft  configuration  and  a  range 
of  tests  will  be  performed. 

Typical  tests  are  system  interaction  tests,  onboard  transmitter  tests,  and  external  transmitter  tests.  System 
interaction  tests  are  performed  to  ensure  that  all  aircraft  systems  are  mutually  compatible  with  each  other, 
and  in  particular  with  the  FCS.  Thus,  all  modes  of  operation  of  each  aircraft  system  must  be  selected 
and  exercised  during  engine  running  tests  to  ensure  freedom  from  cross  system  interactions.  Where 
appropriate,  measurements  may  be  made  of  transients  produced  on  the  aircraft  electrical  bus  bars 
as  manually  or  automatically  switched  functions  are  operated.  All  onboard  transmitters  are  exercised  across 
their  frequency  range  at  normal  and,  where  possible,  at  enhanced  power  levels  to  ensure  freedom  from 
EMI.  Testing  against  external  transmitters  can  also  be  performed  in  a  number  of  ways.  Traditionally, 
the  aircraft  under  test  has  been  exposed  to  each  type  of  external  transmitter  likely  to  be  encountered  during 
its  development  and  then  ultimately  its  service  life.  Current  test  techniques  utilize  a  test  site  with  antennas 
capable  of  exposing  the  live  aircraft  to  radiation  over  the  appropriate  range  of  frequencies  (typically  2  to 
1,000  MHz  for  RF  and  1  to  -8  GHz  for  microwave  frequencies).  Monitoring  the  behavior  of  the  FCS  during 
these  tests  can  be  done  in  a  variety  of  ways.  One  option  is  to  use  the  instrumentation  system,  but  this 
requires  careful  interpretation  since  the  instrumentation  system  on  an  aircraft  can  itself  suffer  from  EMI. 
Instrumentation  may  be  more  likely  to  suffer  from  EMI  because  it  is  not  necessarily  designed  to  the  same 
high  levels  of  EMC  hardness  as  the  actual  aircraft  systems. 

The  generation  of  a  clearance  to  fly  in  conditions  of  high-lightning  risk  is  also  very  important  in  an  aircraft 
development  flight  program  and  is  essential  for  a  service  aircraft.  Such  a  clearance  requires  a  FCS  that  can 
survive  lightning  strikes.  When  digital  computers  were  first  used  in  FCSs,  there  were  concerns  that  their 
processors  could  be  corrupted  by  the  electrical  pulses  generated  by  lightning  strikes.  System  hardware  and 
cable  loom  screening  design  processes  have  been  developed  to  protect  such  equipment  from  lightning 
strike  effects.  These  are  particularly  important  on  aircraft  with  composite  structures.  Although  equipment 
bench  tests  can  be  used  to  demonstrate  equipment  resistance  to  lightning  strikes  and  EMP,  it  is  now  often 
considered  necessary  to  perform  whole  aircraft  lightning  strike  tests  to  validate  the  design  and  clearance 
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process.  Such  a  series  of  tests  requires  a  dedicated  test  facility  including  a  test  frame  tailored  to  the 
particular  type  of  aircraft  under  test.  Although  such  testing  is  usually  carried  out  with  an  unpowered 
aircraft,  there  are  occasions  where  some  testing  is  performed  with  a  live  FCS  and  it  is  important  that  the 
flight  control  engineer  is  familiar  with  such  testing. 

As  the  aircraft  development  program  progresses,  more  EMC  tests  will  be  performed  and  it  is  important  that 
all  changes  to  both  the  FCS  and  the  other  aircraft  systems  are  considered  from  an  EMC  point  of  view. 

3.6  Flight  Test  Planning 
3.6.1  General 

Detailed  test  planning  is  one  of  the  most  important  aspects  of  flight  test  preparation.  This  includes  both 
ground  and  flight  test  plans.  Poor  planning  results  in  a  poorly  conducted,  inefficient,  and  unnecessarily 
risky  flight  test  program.  This  section  details  the  development  of  the  flight  test  plan  using  knowledge  and 
test  data  from  the  ground  tests  as  a  framework.  This  is  not  to  imply  that  flight  test  planning  cannot  begin 
until  the  ground  tests  have  been  completed,  in  fact,  initial  flight  test  planning  should  begin  well  before 
many  of  the  ground  tests  have  been  conducted.  In  general,  test  planning  and  particularly  flight  test 
planning,  should  be  started  early  in  the  system  design  phase.  Data  from  ground  tests  should  be  used  to 
refine  and  update  the  flight  test  plans. 

Preliminary  flight  test  planning  can  occur  as  soon  as  the  aircraft’s  operational  envelope  is  defined.  The  first 
requirement  is  a  set  of  objectives  for  the  development  flight  test  program.  For  most  new  or  modified 
systems  this  would  include: 

a.  Verification  of  safe  operation  throughout  the  envelope, 

b.  Systems  modification  to  ensure  safe  operation  if  necessary, 

c.  Verification,  validation,  and  updating  of  systems  models, 

d.  Validation  of  the  systems  capability  to  meet  mission  requirements,  and 

e.  System  modification  to  ensure  capability  to  meet  mission  requirements. 

These  are  the  top-level,  overall  objectives  that  may  often  be  broken  down  further  into  detailed  objectives, 
which  will  define  specific  data,  test,  and  analysis  requirements.  They  all  follow  the  basic  philosophy  of 
predict,  verify,  update,  and  validate.  Although  they  are  top  level,  they  still  provide  sufficient  information  to 
design  an  initial  flight  test  plan  for  the  DFCS  systems  validation.  The  following  will  assume  that  the 
previously  mentioned  are  the  primary  objectives,  and  describe  the  definition  of  an  appropriate  test  plan  to 
achieve  the  objectives  for  the  DFCS.  General  test  maneuvers  can  be  defined  that  are  appropriate  to  the 
maneuvering  capability  of  the  aircraft.  As  more  complex  models  become  available,  and  the  system  design 
starts  to  mature,  refinements  or  updates  can  be  made  to  the  flight  test  plan.  The  earlier  the  flight  test 
planning  begins,  the  better  thought  out  the  test  program  will  be. 

Test  plans  are  usually  divided  into  regions  for  obtaining  the  objectives.  The  first  is  the  verification  of  the 
safe  operation  within  the  intended  operational  envelope.  The  second  is  verification  of  safe  recovery  from 
areas,  which  may  be  outside  the  intended  operational  envelope,  but  may  be  entered  as  a  result  of 
maneuvering  within  the  operational  envelope.  This  would  include  such  areas  as  departure  and  spin  testing. 
The  third  area  is  the  final  validation  of  the  systems  mission  suitability  or  effectiveness.  The  first  two  areas 
are  usually  considered  envelope  expansion,  and  the  final  area  may  be  a  portion  of  the  envelope  expansion 
or  an  entirely  separate  evaluation  considered  independently  of  the  envelope  expansion. 
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3.6.2  Data  Requirements 

The  data  and  analysis  requirements  are  specifically  linked  to  the  test  objectives.  The  requirements  must  be 
designed  so  that  they  lead  to  the  accomplishment  of  the  objectives.  Specifically,  this  means  that  the 
instrumentation,  maneuvers,  test  conditions,  and  analyses  are  designed  to  provide  information  on  stability 
and  control,  open  loop  flying  qualities,  handling  qualities,  model  updating,  and  validation.  In  order  to 
accomplish  this,  the  DFCS  test  team  must  work  in  conjunction  with  the  design  engineers  to  define  the 
specific  information  required.  This  will  ensure  that  the  test  plan  objectives  are  achievable.  Test  safety  and 
efficiency  must  always  be  kept  in  mind  when  developing  the  test  plan.  Safety  will  dictate  the  order  in 
which  test  points  should  be  accomplished,  generally  building  up  from  least  to  most  critical.  Test  efficiency 
will  dictate  that  the  maximum  information  be  extracted  from  each  maneuver  while  at  each  test  point. 

The  first  consideration  is  obtaining  data  involving  system  stability  and  stability  margins.  These  can  often  be 
obtained  from  classic  maneuvers,  which  provide  step,  or  sinusoidal  inputs  and  swept  sin  wave  frequency 
sweeps.  Properly  instrumented  aircraft  can  provide  data  on  the  open-loop  frequency  response  and  stability 
margins,  frequency  and  damping  of  the  closed-loop  system  and  frequency  and  damping  of  structural 
interactions.  Closed-loop  system  damping  can  be  determined  from  a  simple  input  such  as  a  doublet. 
Doublets  should  be  small  amplitude  (within  the  bounds  of  linearity)  and  limited  to  a  single  cycle.  They  can 
be  performed  in  each  axis,  pitch,  roll,  and  yaw.  Doublets  not  only  provide  data  on  basic  closed  FCS  loop 
frequency  and  damping  performance,  but  can  also  be  used  for  aerodynamic  parameter  estimation 
(as  discussed  in  a  later  section).  The  doublet  is  usually  preferred  over  the  step  input  since  it  tends  to  return 
the  aircraft  to  the  original  conditions  as  opposed  to  a  new  condition  defined  by  the  step  input. 

Another  maneuver,  which  takes  longer  than  the  doublet,  but  will  provide  more  data,  is  the  frequency 
sweep.  This  is  a  sin  wave  with  varying  amplitude  and  frequency  with  time.  Data  from  the  frequency  sweep 
can  be  used  in  conjunction  with  a  FFT  analysis  routine  to  derive  the  frequency  response  characteristics.  The 
frequency  response  is  only  valid  over  the  range  of  frequency  input,  but  this  is  usually  sufficient  to 
adequately  define  the  system.  Closed  FCS  loop  frequency  and  damping  as  well  as  open  FCS  loop 
characteristics  can  be  derived,  depending  on  instrumented  parameters.  These  sweeps  are  also  often 
accomplished  in  each  axis.  Both  doublets  and  frequency  sweeps  may  have  to  be  repeated  at  varying 
magnitudes  if  investigating  a  highly  nonlinear  system.  The  variation  in  input  magnitude  will  be  dictated  by 
the  level  of  nonlinearity  as  well  as  test  safety.  Frequency  sweeps  can  also  be  used  for  aerodynamic 
parameter  estimation. 

Pilot-out-of-the-loop  flying  qualities  will  be  evaluated  with  the  previously  mentioned  maneuvers  as  well  as 
other  maneuvers  such  as  aileron  rolls,  rudder  rolls,  steady  sideslips,  and  elevated  g  turns  (wind-up  turns 
[WUT]).  The  pilot-out-of-the-loop  refers  to  the  pilot  inputting  predefined,  constant  or  slowly  varying  inputs 
and  not  actively  reacting  to  or  shaping  the  input  for  a  desired  response.  Aileron  rolls  provide 
information  on  the  aircraft’s  lateral  response  characteristics,  multiple  axis  coupling,  maximum  roll  rate 
and  roll  mode  time  constant.  Steady-heading  or  wings-level  sideslips  provide  information  on  the  basic 
static  stability  characteristics  with  sideslip.  These  are  usually  limited  to  the  steady-state  sidelsips  achievable 
by  the  aircraft.  Higher  sideslip  may  be  generated  by  rolls  or  other  maneuvers.  Slowly  varying  g  turns  or 
WUT  provide  information  at  elevated  AOA.  The  WUTs  will  give  information  on  apparent  stability  to 
the  pilot  and  trim  authority.  Maneuvers  such  as  rolls  (both  aileron  and  rudder)  at  elevated  AOA  will 
provide  data  on  aircraft  axis  coupling,  both  inertial  (gyroscopic)  and  kinematic  (exchange  of  AOA  and 
sideslip  during  a  roll). 

Handling  qualities  maneuvers  will  provide  information  on  pilot-in-the-loop  control  of  the  system.  The  pilot 
is  free  to  react  to  system  response  with  inputs  during  pilot-in-the-loop  maneuvers.  In  this  sense,  the  pilot 
acts  as  an  additional  control  system,  and  as  such,  can  have  similar  performance  and  stability  problems  as 
any  closed-loop  system.  These  problems  can  be  small  and/or  annoying  but  acceptable,  or  as  bad  as 
explosive  PIO.  The  ability  of  the  pilot  to  aggressively  command  the  aircraft  response  will  directly  impact 
the  ability  of  the  system  to  perform  the  required  mission.  The  mission  will  determine  the  amount  of  precise 
and  aggressive  control  required  by  the  pilot.  Air-to-air  combat  will  obviously  require  a  higher  level  of 
aggressiveness  and  precision  than  cruising  from  one  location  to  another.  Handling  qualities  test  maneuvers 
must  be  designed  to  adequately  reflect  the  intended  mission  of  the  aircraft  as  well  as  to  find  any  cliffs 
which  may  occur  as  the  result  of  unexpected  occurrences  such  as  gust  upsets. 
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Handling  qualities  are  most  often  evaluated  using  specific  representative  mission  maneuvers  such  as  air  to 
air  tracking,  formation  flying,  aerial  refueling,  and  landing.  These  maneuvers  are  usually  qualitatively 
evaluated  via  the  Cooper-Harper  rating  scale  (Reference  3).  In  order  to  apply  the  rating  scale,  specific  tasks 
along  with  desirable  and  adequate  performance  must  be  defined.  Figure  6  presents  the  Cooper-Harper 
rating  scale.  The  scale  is  used  by  starting  at  the  bottom  and  following  the  decision  tree  to  achieve  a 
rating.  The  Cooper-Harper  scale  is  not  a  linear  1  to  10  scale  rating  system.  To  achieve  valid  data,  the 
specific  tasks  and  the  desired  and  adequate  performance  must  be  specified  and  the  decision  tree  followed 
for  each  evaluation.  Simply  performing  an  undefined  task,  without  performance  criteria,  and  supplying  a 
1  to  10  linear  rating  is  not  valid.  The  Cooper-Harper  scale  shown  in  Figure  6  is  typically  broken  up  into 
3  Levels.  Level  I  (1  to  3)  specifies  a  satisfactory  system.  Deficiencies  are  usually  considered  acceptable. 
Level  II  (4  to  6)  indicates  a  less  than  satisfactory,  but  often  an  acceptable  system.  The  deficiencies  may  or 
may  not  require  improvements  to  achieve  the  mission.  Level  III  (6  to  9)  indicates  an  inadequate  system 
where  the  deficiencies  usually  require  improvement.  A  Cooper-Harper  rating  of  10  has  no  level,  as  it  is  an 
uncontrollable  system.  It  should  be  noted  that  the  stability  indicated  may  or  may  not  be  a  system  instability. 
The  instability  may  be  a  result  of  a  PIO  as  the  pilot  acts  as  a  secondary  FCS  wrapped  about  the  system. 


ADEQUACY  FOR  SELECTED  TASK  AIRCRAFT  DEMANDS  ON  THE  PILOT  PILOT 

OR  REQUIRED  OPERATION  CHARACTERISTICS  IN  SELECTED  TASK  OR  REQUIRED  OPERATION  RATING 


Figure  6  Ten  Point  Cooper-Harper  Rating  Scale 


The  PIO  may  or  may  not  appear  during  the  normal  handling  qualities  evaluations.  Many  PIO  occurrences 
are  a  result  of  some  form  of  trigger  not  normally  encountered  during  routine  flight.  The  event  may  be 
something  such  as  an  emergency  disconnect  from  the  tanker,  rapid  maneuver  to  avoid  collision,  or  sudden 
turbulence  or  gust.  Pilot-in-the-loop  oscillations  encountered  during  these  conditions  are  usually  a  high 
bandwidth  pilot  reaction  to  the  abrupt  aircraft  response.  Normal  handling  qualities  testing  may  or  may  not 
evaluate  the  aircraft’s  PIO  susceptibility  under  these  conditions.  Other  piloted  evaluations  have  been 
developed  to  try  to  separate  these  types  of  PIO  tendencies  from  the  normal  operating  envelope.  Reference  2 
describes  the  so-called  HQDT  technique  developed  at  the  AFFTC.  The  name  is  a  misnomer,  since  the 
technique  really  evaluates  PIO  susceptibility,  and  is  not  a  normal  air-to  air  tracking  technique  as  used  in 
combat  or  the  previously  mentioned  handling  qualities  evaluations.  Handling  qualities  during  tracking,  as 
defined  in  Reference  2,  is  a  specific  high  bandwidth,  zero-error  attempt  to  track  a  specified  point  on  a 
maneuvering  target.  The  pilot  should  aggressively  zero  out  any  error  between  the  desired  and  actual 
aimpoint.  This  is  done  to  achieve  the  highest  possible  pilot  bandwidth  in  order  to  search  for  PIO  tendencies. 
The  technique  as  described  in  Reference  2  is  not  meant  to  replicate  realistic  pilot  tracking  techniques.  The 
HQDT  technique  does  not  specify  desired  and  adequate  criteria;  hence,  use  of  the  Cooper-Harper  rating 
scale  is  not  appropriate.  Instead,  a  PIO  rating  scale,  as  shown  in  Figure  7,  is  used  to  categorize  PIO 
susceptibly  and  impact.  The  HQDT  technique  has  been  involved  in  much  controversy  over  the  years,  yet 
remains  one  of  the  few  consistent  tools  available  to  test  for  PIO.  Much  of  the  controversy  comes  from  the 


29 


misnomer  mentioned  earlier.  The  technique  is  really  a  PIO  evaluation  technique,  and  not  an  evaluation  of  a 
mission  representative  maneuver. 
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Figure  7  Pilot-In-The-Loop  Oscillation  Rating  Scale 

3.6.3  Envelope  Expansion 

Envelope  expansion  test  plans  are  laid  out  in  a  buildup  fashion  going  from  the  region  of  lowest  to  highest 
uncertainty.  The  largest  areas  of  uncertainty  are  in  the  rigid-body  aerodynamics,  the  flexible  aerodynamics 
and  the  unsteady  aerodynamics  associated  with  flutter  and  ASE.  These  uncertainties  are  highest  at  transonic 
Mach  numbers,  high  AOA,  sideslip,  and  dynamic  pressures.  The  envelope  expansion  plan  must  therefore 
account  for  these  uncertainties  in  the  buildup  process.  This  section  will  describe  some  techniques  which 
can  be  employed.  This  is  not  the  only  technique  which  can  be  used,  but  it  is  illustrative  of  the  thought 
process  required  for  developing  an  envelope  expansion  test  plan. 

Once  a  set  of  given  objectives  have  been  defined,  the  next  step  in  developing  the  envelope  expansion  plan 
is  to  obtain  the  expected  operational  envelope  of  the  aircraft.  Once  the  Mach  number,  or  airspeed,  altitude, 
AOA  and  load-factor  limits  are  known,  envelope  regions  can  be  developed  for  the  expansion  process.  Basic 
flight  test  principles  and  maneuvers  can  then  be  used  to  start  filling  in  the  test  conditions  and  maneuvers 
within  these  regions. 

The  DFCS  flight  test  team  must  obtain  the  Mach,  altitude,  dynamic  pressure,  load  factor  and  dynamic 
pressure  envelopes  of  the  aircraft  as  shown  in  Figure  8.  Once  these  limits  are  known,  then  intermediate 
AOA  and  load-factor  limits  should  be  selected.  The  intermediate  load  factor  limit  is  usually  80  percent  of 
the  design  limit  load  (DLL).  The  intermediate  AOA  limit  is  usually  1.3  times  the  stall  airspeed  or  in  the 
case  of  fighter  aircraft  less  than  15  to  25  degrees  AOA.  Expansion  beyond  these  AOA  and  load  factor 
limits  usually  requires  specially  equipped  aircraft,  and  will  occur  later  in  the  test  program.  The  envelope 
should  then  be  divided  into  regions  as  indicated  in  Figure  9.  The  regions  are  as  follows: 

Region  1  First  or  initial  flights  envelope 

Region  2  Max  altitude/Mach  number  expansion  envelope 

Region  3  Initial  Limit  AOA  expansion  envelope 

Region  4  Maximum  dynamic  pressure  expansion  envelope 

Region  5  Maximum  lift  or  AOA  envelope 
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Testing  will  normally  progress  in  numerical  order  from  Regions  1  to  2  to  3  and  finally  to  Region  4; 
however.  Region  3  is  usually  cleared  in  conjunction  with  Region  2  and  as  such,  may  be  considered  a  subset 
of  Region  2.  Extended  loads  and  the  high  AOA  test  programs  will  then  be  conducted  to  the  final  load  factor 
and  AOA  limits  within  Regions  4  and  5.  These  will  usually  come  after  the  initial  envelope  expansion  and 
will  be  covered  separately. 

A  first  flight  or  first  flights  envelope  (Region  1)  should  first  be  established.  First  flights  are  a  unique  case  and 
the  details  will  depend  on  whether  the  system  is  new  or  a  modification  of  an  existing  system.  The  limits 
should  be  set  within  areas  for  which  the  uncertainty  is  low.  Mach  number,  dynamic  pressure,  and  AOA  should 
be  kept  low.  The  initial  envelope  should  be  set  at  10,000  to  20,000  feet,  AOA  and  load  factor  as  previously 
specified,  and  an  airspeed  or  dynamic  pressure  limit  below  0.7  Mach  number  and  200  to  350  KCAS. 
The  dynamic  pressure  envelope  may  be  defined  in  either  incompressible  dynamic  pressure,  equivalent 
airspeed  or  in  terms  of  compressible  impact  pressure,  and  calibrated  airspeed.  Loads  and  structural  engineers 
usually  define  limits  in  incompressible  dynamic  pressure  or  equivalent  airspeed.  The  AOA  limit  for  the  first 
flights  depends  on  the  type  of  aircraft.  Large  transports  or  general  aviation  aircraft  approach  aerodynamic  stall 
during  the  landing  flair,  and  therefore,  AOA  up  to  initial  stall  may  be  set  as  the  limit.  For  fighter-type  aircraft 
where  aerodynamic  stall  is  well  above  approach  and  flair  AOA,  a  limit  of  maximum  flair  AOA  may  be  set. 

The  Region  2  envelope  is  usually  defined  on  the  right  by  the  maximum  dynamic  pressure  at  the  maximum 
Mach  number  and  altitude  combination  and  on  the  left  by  an  AOA  15  to  20  percent  lower  than  the  initial 
limit.  This  limit  should  allow  at  least  2  to  3  gs  maneuvering  load  factor  capability  at  the  lower  airspeed  bounds 
of  the  Region  2  envelope. 

Region  3  is  defined  on  the  right  by  the  AOA  limit  of  Region  2  and  on  the  left  by  the  initial  AOA  limit. 
Region  3  is  often  cleared  in  conjunction  with  Region  2,  and  as  such  may  be  viewed  more  as  a  subset 
of  Region  2. 

The  Region  4  envelope  is  bounded  by  the  maximum  Mach  number  and  dynamic  pressure  on  the  right,  and  on 
the  left  by  the  initial  dynamic  pressure  limit  or  the  extent  of  the  Region  1  expansion. 

Region  5  is  the  maximum  AOA  expansion  from  the  initial  AOA  limit.  This  is  the  portion  of  the  envelope  up 
to  and  above  stall  AOA.  For  fighter  and  trainer  aircraft,  this  is  where  the  departure,  spin  and  other  out-of- 
control  situations  are  evaluated.  This  region  often  requires  specially  equipped  aircraft  to  ensure  safe  recovery 
from  out  of  control  situations.  Features  such  as  stall  or  spin  recovery  parachutes,  special  backup  power 
systems  and  instrumentation  are  often  used  for  this  region. 


Figure  8  Basic  Aircraft  Envelopes 
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Figure  9  Typical  Envelope  Expansion  Regions 

3.6.3.1  Envelope  Expansion  Maneuvers 

Within  each  Region,  the  envelope  is  expanded  in  an  orderly  fashion,  using  a  3-step  approach. 
Step  1  involves  basic  DFCS,  flutter  and  ASE  stability,  aerodynamic  parameter  estimation  maneuvers 
and  mild  maneuvering.  Step  2  involves  more  aggressive  maneuvering  to  specified  limits  and  high  gain 
handling  qualities  testing  such  as  HQDT.  Step  3  is  a  final  operational  handling  qualities  and  mission 
effectiveness  evaluation.  Steps  1  and  2  are  the  primary  safety  oriented  steps  in  the  envelope  expansion 
process.  Step  3  may  be  done  in  conjunction  with  the  other  Steps  or  may  be  delayed  until  a  safe  envelope 
has  been  defined  by  Steps  1  and  2. 

Figure  10  shows  some  of  the  typical  maneuvers  performed  as  well  as  information  they  provide  during  a 
DFCS  envelope  test  process.  Not  all  test  programs  will  use  every  maneuver.  Step  1  maneuvers  test  the 
basic  FCS,  ASE  and  flutter  stability  as  well  as  collect  data  for  system  parameter  identification  and  model 
updating.  Step  1  also  demonstrates  mild  maneuvering  capability  and  elevated  load-factor  capability.  Step  2 
further  expands  the  maneuvering  capability  to  full  inputs  and  load  factor.  Step  2  also  tests  for  PIO 
susceptibility  using  zero  error,  high-bandwidth  tracking  (HQDT).  Step  3  covers  mission-related  maneuvers 
and  operationally-related  handling  qualities. 


Step 

Maneuvers 

Purpose 

1 

1-g  trims 

Control  raps 

3  axis  doublets 

Frequency  sweeps 

PTI  for  PID 

1-g  partial  stick  rolls 

1  -g  partial  rudder  pedal  rolls 

Partial  pedal  sideslips 

Wind-up  turns  (  WUT  )  to  elevated  g 

Basic  trim  capability,  stability  and  control,  aero -servo-elasticity, 

Parameter  ID  maneuvers,  roll  capability,  roll  coupling  for  small  inputs, 
elevated  g  characteristics 

2 

1-g  full  pedal  sideslips 

1  -g  full  stick  rolls 

WUT  to  Nz  /AOA  limit 

Elevated  g  rolls,  partial  input 

Elevated  g/AOA  rolls,  full  input 

HQDT  for  PIO 

Maximum  maneuvering  stability  and  control,  maneuvering  at  max  g/AOA,  PIO 
susceptibility 

3 

1-g  Cross  control  /  coupled  maneuvers 

Elevated  g/AOA  cross  control/coupled 
maneuvers 

Operational  handling  qualities 

Air-to-Air  tracking 

Air-to-ground  tracking 

Aerial  refueling 

Offset  landings 

Systems  unique  HQ 

Misapplied  controls  maneuvering,  operational  effectiveness 

Figure  10  Typical  Envelope  Expansion  Maneuvers 
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3.6.3.2  Order  of  Expansion  for  Region  1 

The  first  flight,  or  set  of  flights,  for  any  aircraft  are  always  a  unique  occurrence.  This  applies  not  only  to 
new  aircraft,  but  also  to  those  with  modifications.  By  necessity  they  must  all  takeoff,  conduct  tests  in  some 
portion  of  the  envelope  and  land.  The  landing  is  often  considered  one  of  the  more  dangerous  portions  of 
these  flights,  particularly  with  a  new  aircraft  or  new  set  of  control  laws.  Handling  qualities  problems  near 
the  ground  can  be  a  dangerous  situation.  Many  decisions  must  be  made  on  the  first  flight  of  any  new 
aircraft,  which  deal  with  not  only  the  flight  controls  and  flying  qualities  issues,  but  also  with  other  systems 
operations.  For  first  flights  of  modified  aircraft,  these  issues  of  other  systems  operations  may  or  may  not 
come  into  play  depending  on  the  specific  modifications. 

The  objectives  of  the  first  flight  are  to  takeoff,  obtain  a  limited  amount  of  data  to  compare  to  predictions, 
and  safely  land.  Because  of  the  limited  objectives,  many  programs  prefer  to  leave  the  gear  down  on  first 
flight  to  avoid  potential  complicating  factors  such  as  FCS  mode  transients  or  landing  gear  being  stuck  in 
the  retracted  position.  Other  programs  may  elect  to  retract  the  gear  as  part  of  the  data  required  from  first 
flight.  Whichever  course  is  taken,  the  first  concern  must  be  to  ensure  a  safe  landing  capability.  This  means 
that  tests  to  verify  the  flying  qualities  in  the  power-approach  mode  should  be  conducted  as  soon  as  possible 
after  takeoff,  and  preferably  before  raising  the  gear  for  the  first  time. 

Figure  1 1  shows  an  example  first  flight  profile  to  verify  the  flying  qualities  in  the  power-approach  mode 
prior  to  the  first  retraction  of  the  landing  gear.  Takeoff  and  climb  to  the  intended  test  altitude  (gear  down) 
is  accomplished  between  the  approach  and  gear-limit  speeds.  Test  maneuvers  are  then  performed  at  the 
speed  and  altitude  indicated  by  point  A  in  Figure  11.  A  deceleration  to  the  approach  speed  is  then 
accomplished  and  a  similar  set  of  maneuvers  performed  (point  B  in  Figure  1 1).  A  further  deceleration  to  an 
AOA  15  to  20  percent  below  approach  speed  should  then  be  accomplished  to  ensure  adequate  stability  and 
control  for  AOAs  slightly  above  those  at  approach  speed  (point  C  in  Figure  11).  The  maneuver  set  at  point 
C  will  most  likely  be  a  subset  of  those  performed  at  the  previous  points.  An  acceleration  back  to  the 
original  climbout  speed  is  then  accomplished  and  elevated  load  factor  maneuvers  are  accomplished  to  the 
approach  AOA  and  slightly  above  (point  D  in  Figure  1 1). 


Figure  1 1  Typical  First  Flight  Profile 

Following  these  basic  stability  and  mild  maneuvering  tests,  high-gain  handling  qualities  are  evaluated  with 
a  zero  error  HQDT  maneuver  to  evaluate  PIO  susceptibility.  These  should  first  be  performed  at  the  initial 
climbout  speed  and  altitude,  followed  by  the  approach  speed  and  an  AOA  slightly  higher  than  approach 
speed.  The  high-gain  tracking  may  be  followed  by  practice  landings  at  altitude.  The  final  approach  and 
landing  can  then  be  accomplished  with  the  pilot  having  some  knowledge  of  the  general  aircraft  flying 
qualities  capability  before  the  actual  landing.  These  maneuvers  should  be  performed  at  the  beginning  of  the 
first  flight.  As  with  any  new  system,  one  never  knows  when  system  problems  may  require  an  immediate 
abort  of  the  flight.  Accomplishing  these  as  soon  as  possible  maximizes  the  chance  that  they  will  be 
completed  prior  to  the  first  landing.  Most  modern  fighter-type  or  highly  maneuverable  aircraft  have  high 
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aerodynamic  stall  AOA  and  most  likely  will  not  approach  these  AOAs  during  the  landing  flair.  For  this 
reason,  full  stalls  on  the  first  flights  are  not  a  good  idea.  However,  transport  and  many  training  aircraft  will 
approach  aerodynamic  stall  on  landing.  With  these  aircraft,  slow  1-g  stall  entries  are  often  performed  on  the 
first  flight  to  evaluate  the  stall  characteristics. 

Following  the  power  approach  flying  qualities  evaluation,  the  first  flight  can  proceed  to  raising  the  gear  and 
conducting  further  expansion  as  shown  in  Figure  12  (points  E  through  H).  This  can  either  be  done  on 
subsequent  flights  or  during  the  first  flight.  The  goal  is  to  get  to  a  Mach  number,  airspeed  and  altitude  from 
which  to  start  the  Region  2  expansion  (Point  H  in  Figure  12). 

The  initial  altitude  limit  for  Region  1  will  depend  on  the  type  of  aircraft  being  tested.  In  general,  heavier 
and  faster  aircraft  will  have  higher  initial  altitudes  than  slower  lighter  aircraft.  For  example,  a  military 
fighter  or  transport  may  pick  an  initial  altitude  between  15,000  to  20,000  feet,  while  a  small  general 
aviation  aircraft  may  use  an  altitude  as  low  as  5,000  feet. 

3.6.3.3  Order  of  Expansion  for  Regions  2  and  3 

The  Region  2  expansion  to  maximum  calibrated  or  equivalent  airspeed  can  begin  anytime  after  the  first 
flight  or  after  the  gear  are  raised  for  the  first  time.  The  objective  is  to  reach  the  maximum  Mach  number  or 
airspeed  at  the  maximum  altitude.  Once  this  has  been  achieved,  then  the  Region  3  expansion  can  begin  at 
the  maximum  altitude.  Figure  13  shows  a  diagram  of  the  expansion  process  for  Regions  2  and  3. 


Figure  12  Further  Expansion  of  Region  1 
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Figure  13  Typical  Expansion  Process  for  Regions  2  and  3 

The  first  goal  after  raising  the  gear  should  be  to  expand  to  an  anchor  point  (point  H  in  Figure  12). 
A  stair-step  approach  to  reach  the  maximum  Mach  number  and  initial  dynamic  pressure  limit  is  followed 
from  point  H,  Figure  12,  to  point  J,  Figure  13.  A  constant  airspeed  climb  is  initiated  at  the  anchor  point 
altitude  at  an  airspeed  below  that  of  the  anchor  point.  A  constant  airspeed  climb  is  desired,  since  this  will 
tend  to  maintain  AOA.  This  climb  is  maintained  until  an  altitude  where  the  initial  Mach  number  of  the 
anchor  point  is  established.  Once  at  this  altitude,  an  expansion  to  the  Mach  number  corresponding  to  the 
anchor  point  airspeed  or  dynamic  pressure  is  conducted.  New  altitudes  are  selected  to  keep  the  Mach 
number  with  the  constant  climb  airspeed  below  the  maximum  Mach  number  expanded  to  at  the  previous 
altitude.  This  process  is  repeated  until  the  maximum  altitude  is  reached.  Once  at  the  maximum  altitude, 
expansion  continues  to  the  maximum  Mach  number  and  airspeed  combination,  point  J,  Figure  13.  Once  the 
maximum  Mach  number  and  altitude  are  cleared,  expansion  to  the  left  into  Region  3  can  begin  at  the 
maximum  altitude  (points  K,  N,  P  Figure  13).  Expansion  to  the  dynamic  pressure  for  maximum  Mach 
number  at  lower  altitudes  (points  F  to  S,  Figure  13)  can  also  proceed  at  this  point.  Maneuvers  to  the 
dynamic  pressure  for  maximum  Mach  number  and  altitude  combination  and  expansion  into  Region  3 
can  be  carried  out  independent  of  each  other;  however,  it  may  be  more  efficient  to  expand  to  both  limits 
while  at  a  given  altitude. 

Not  all  maneuvers  at  each  Mach  number  and  altitude  combination  need  be  completed  prior  to  moving  to 
the  next  combination.  In  fact,  this  is  not  necessarily  the  best  approach.  A  similar  stair  step  approach  using 
the  Step  1  and  2  maneuvers  of  Figure  10  can  be  employed.  For  example,  it  may  be  wise  to  clear  the 
1-g  stability  maneuvers  from  Step  1  at  several  Mach  numbers  ahead  of  the  Step  2  maneuvers. 

3.6.3  A  Order  of  Expansion  for  Region  4 

Region  4  expansion  to  the  maximum  dynamic  pressure  usually  begins  after  completion  of  the  Region  2 
and  3  expansion.  The  expansion  is  done  by  lowering  the  altitude  and  expanding  in  increments  of  Mach 
number  or  dynamic  pressure  as  shown  in  Figure  14.  The  expansion  can  proceed  either  to  the  full  maximum 
Mach  number  and  dynamic  pressure  or  in  dynamic  pressure  increments.  This  will  most  likely  be 
determined  by  structural  dynamics  considerations. 
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Figure  14  Typical  Maximum  Mach/Dynamic  Pressure  Expansion 

3.6.3.5  Expansion  for  Region  5 

The  Region  5,  or  high  AOA  expansion  is  usually  done  last,  although  it  may  be  done  at  the  same  time  as 
other  regions  if  multiple  aircraft  are  used.  Region  5  typically  tests  for  stall,  departure,  and  spin  or  deep  stall, 
and  recovery  characteristics.  Specially  equipped  aircraft  are  often  required  for  expansion  into  Region  5. 
Special  considerations  such  as  recovery  parachutes  and  emergency  power  sources  are  often  required.  These 
are  most  often  used  on  military-type  aircraft,  although  some  general  aviation  programs  also  use  these 
devices.  The  requirement  to  use  such  devices  depends  on  the  intended  use  of  the  operational  aircraft  and 
the  potential  for  unrecoverable  out-of-control  modes.  Military  fighters  often  maneuver  in  a  high  AOA 
envelope,  and  may  be  susceptible  to  departure  and  possibly  spins  or  deep  stalls.  Transport  aircraft  usually 
do  not  enter  regions  near  stall  intentionally  and  may  not  require  extensive  testing  for  spins  or  deep  stalls. 

The  United  States  military  has  traditionally  used  MIL-F-83691B,  Military  Specification  Flight  Test 
Demonstration  Requirements  for  Departure  Resistance  and  Post-Departure  Characteristics  of  Piloted 
Airplanes  (Reference  4),  for  many  years  as  a  guide  to  testing  in  this  region.  The  MIL-F-83691B  spells 
out  a  detailed  approach  to  testing  departure,  spin,  or  deep-stall  susceptibility.  There  are  generally  four 
phases  of  such  testing.  Different  phases  are  recommended  for  different  classes  of  aircraft  as  defined  by 
MIF-F-1797  (Reference  13)  or  MIF-F-8785.  Phase  A  is  straight  ahead  1-g  stalls  and  accelerated  stalls,  with 
recovery  immediately  after  stall  indication.  Phase  B  is  stalls  with  momentary  aggravated  inputs  such  as 
cross  control  or  holding  the  stall.  Phase  C  are  the  same  inputs,  except  held  for  larger  specified  time  periods. 
Phase  D  is  usually  attempted  spins,  deep  stalls  or  other  sustained  poststall  out  of  control  maneuvers.  The 
MIF-F-83691B  also  provides  information  on  instrumentation  and  emergency  device  requirements. 

Appropriate  departure  and  spin  and/or  deep  stall  susceptibility  should  be  investigated  throughout  the 
aircraft’s  operational  envelope  and  configuration.  This  includes  eg  range  and  loading  asymmetries.  The  use 
of  simulation  can  be  a  great  aid  in  helping  reduce  the  unknowns  in  this  region,  providing  that  sufficient 
predictive  wind  tunnel  work  has  been  accomplished  to  lend  credibility  to  predictions. 

3.7  Safety  Planning 
3.7.1  General 

Flight  test  safety  planning  is  one  of  the  most  important  tasks  of  any  flight  test  team.  Most  flight  test 
organizations  have  specific  test  safety  planning  guidelines  for  the  DFCS  test  team  to  follow,  as  well  as 
dedicated  safety  reviews  prior  to  flight.  The  major  benefit  of  the  reviews  is  most  often  found  in  the 
preparation  by  the  team  for  the  review.  The  key  to  successful  safety  planning  is  involving  the  whole  test 
team  in  the  process;  this  includes  both  engineers  and  pilots.  The  safety  planning  process  is  in  reality  a  risk 
management  exercise.  All  flight  test  programs  have  inherent  risk;  it  is  physically  and  financially  impossible 
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to  eliminate  risk.  The  safety  planning  process  attempts  to  strike  a  balance  between  reasonable  risk 
minimization  and  test  efficiency. 

3.7.2  Hazard  Identification  and  Minimization 

A  primary  consideration  for  risk  management  is  to  start  developing  the  safety  plan  early  in  the  test  planning 
process.  As  in  test  planning,  much  of  the  detail  will  yet  to  be  preliminary,  but  the  thought  process 
should  begin.  Results  from  many  of  the  tests,  analyses  and  simulations  previously  defined  in  this  document 
should  be  used  in  developing  the  safety  plan.  One  of  the  more  useful  results  will  be  from  the  failure  modes 
and  effects  analysis  and  the  failure  modes  and  effects  tests.  Experienced  flight  test  experts  are  also 
a  valuable  source  for  insight  into  potential  test  risks  and  should  be  consulted  regularly  during  the  safety 
plan  development. 

The  basis  for  safety  planning  lies  in  defining  both  the  ground  and  flight  test  unique  hazards.  The  hazards 
should  be  unique  to  the  test,  and  not  general  hazards  which  are  always  present  when  performing  ground  or 
flight  operations.  As  an  example,  a  bird  strike  hazard  would  normally  be  considered  nontest  unique  unless 
there  is  something  in  the  test  plan  that  elevates  the  risk  of  bird  strike  above  that  occurring  during  normal 
flight  operations.  On  the  other  hand,  a  loss  of  control  hazard  would  be  quite  applicable  during  the  high 
AOA  envelope  expansion  of  a  new  aircraft  or  FCS.  The  criticality  of  the  hazard  should  also  be  defined  in 
terms  of  a  possible  loss  of  aircraft  or  life,  major  aircraft  damage  or  personal  injury  or  minor  aircraft  damage 
with  no  injuries.  Hazards  also  have  causes;  for  example  a  loss  of  control  hazard  may  be  caused  by  a  FCS 
failure  or  unpredicted  aerodynamics.  Potential  causes  for  hazards  should  be  identified  where  possible. 
This  may  come  from  the  results  of  tests,  analyses,  simulations  or  previous  flight  test  experience. 

Once  the  test  unique  hazards  and  their  causes  have  been  defined,  the  test  team  should  define  techniques  or 
procedures  to  minimize  the  occurrence  of  the  hazard  or  its  causes.  Minimization  procedures  may  include 
monitoring  of  critical  systems,  buildup  procedures  designed  to  spot  a  hazard  prior  to  occurrence,  additional 
tests  or  checkout  procedures.  The  idea  is  to  test  in  an  intelligent  fashion  and  avoid  unnecessary  risks.  This 
is  best  accomplished  by  devoting  considerable  time  and  effort  to  thinking  about  what  can  go  wrong.  The 
objective  is  to  perform  risk  management,  not  necessarily  risk  avoidance.  In  determining  the  hazards  and 
minimizing  procedures,  the  test  team  is  really  deciding  what  is  the  reasonable  level  of  effort  to  minimize 
the  chance  of  a  hazard  occurring.  They  try  to  strike  a  balance  between  reasonable  expenditure  of  resources 
and  acceptable  risk.  There  is  no  single  formula  to  apply  to  make  this  determination,  each  program  and 
situation  will  be  different,  and  must  be  addressed  based  on  available  data  and  experience. 

The  safety  process  should  also  define  corrective  actions  to  be  implemented  if  one  or  more  of  the  causes  for 
a  hazard  should  occur.  There  may  be  cases  where  no  corrective  actions  are  available  to  prevent  the  hazard 
from  occurring;  however,  where  applicable,  they  should  be  defined.  The  corrective  actions  may  be 
checklist  procedures  such  as  actions  for  an  engine  flame-out,  specific  ground  control  and  pilot  actions  or  as 
simple  as  return  to  base  or  eject.  The  idea  behind  the  corrective  actions  is  to  prevent  the  causes  of  hazards 
from  proceeding  to  the  full-blown  hazard  if  possible.  This  again  is  a  situation  where  risk  management 
applies.  Balancing  the  cost  versus  benefit  of  corrective  actions,  procedures  or  special  equipment  versus  the 
safety  benefit  they  supply  must  be  well  thought  out. 

3.7.3  Safety  Reviews 

The  last  part  of  the  safety  process  is  usually  some  form  of  an  independent  review  of  the  test  and  safety 
planning.  This  review  is  usually  conducted  by  knowledgeable  and  experienced  individuals  not  directly 
connected  to  the  test  program.  Their  function  is  to  take  a  broad  and  independent  view  of  the  program  and 
review  the  entire  planning  process  to  ensure  that  the  team  has  reasonably  considered  and  minimized  the 
potential  hazards.  The  reviewers  will  not  necessarily  be  experts  in  the  specific  test  program,  but  should 
have  experience  in  similar  test  programs.  The  review  is  really  a  final  sanity  check  as  to  whether  the  team 
has  done  an  adequate  test  and  safety  planning  job. 


3.8  Real-Time  Monitoring 

3.8.1  General 
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Real-time  monitoring  of  the  aircraft  behavior  usually  is  required  by  the  specific  safety  considerations  of  the 
program.  Even  if  the  safety  considerations  do  not  dictate  any  need  for  real-time  monitoring,  benefits  can  be 
had  through  monitoring  maneuvers  for  data  quality.  Real-time  monitoring  for  smaller  aircraft  is  usually 
done  by  telemetering  the  required  data  to  a  ground  station  for  display.  Some  large  transport  aircraft 
have  sufficient  room  onboard  to  provide  the  monitoring  on  the  aircraft.  Whichever  method  is  used,  the 
basics  are  similar. 

3.8.2  Required  Real-Time  Parameters 

Safety  planning  will  usually  identify  the  need  for  real-time  monitoring  as  well  as  the  required  safety 
parameters  to  be  monitored.  The  parameters  should  be  divided  into  those  required  for  safety-of-flight 
(SOF),  safety-of-test  (SOT)  or  mission  critical  (MC).  The  SOF  means  that  monitoring  of  the  parameter  is 
required  to  safely  fly  the  aircraft.  These  usually  only  occur  with  new  or  immature  systems.  The  SOT  are 
those  monitoring  requirements  required  for  safely  conducting  a  particular  test,  but  are  not  required  to 
normally  fly  the  aircraft.  The  MC  are  those  parameters,  which  are  required  for  the  test  objectives  to  be  met. 
If  any  SOF  parameter  is  not  working  or  available  for  monitoring,  then  the  aircraft  should  not  fly.  If  any 
SOT  parameter  is  not  working  or  available  for  monitoring  then  the  specific  test  it  is  related  to  should  not  be 
performed.  These  parameters  should  be  identified  before  flight  and  rigidly  adhered  to  during  a  particular 
mission.  The  SOF  or  SOT  parameters  should  be  determined  on  the  ground,  prior  to  the  mission,  and  should 
not  be  changed  during  the  mission.  Mission  critical  decisions  are  not  considered  safety  parameters  and  can 
be  changed  during  the  mission.  Since  monitored  SOF  and  SOT  parameters  may  be  critical  to  the  test 
mission,  and  flight  test  instrumentation  failures  are  common,  the  lists  should  be  as  short  as  possible.  Only 
use  the  parameters  absolutely  required  on  the  SOF  or  SOT  list.  This  deserves  careful  attention  as  it  is 
guaranteed  that  the  situation  will  arise  where  a  needed  SOF  or  SOT  parameter  is  not  available.  Failure  to 
carefully  scrutinize  the  real  need  for  the  parameters  on  these  lists  may  result  in  the  unnecessary  loss  of  a 
test  flight  or  maneuver  due  to  poor  planning.  In  addition,  the  list  should  be  reviewed  periodically  to  ensure 
that  all  parameters  are  still  required  as  well  as  to  ensure  new  parameters  are  added  when  needed.  Another 
useful  tactic  to  minimize  the  impact  of  parameter  loss  is  to  identify  acceptable  backup  sources.  Modern 
aircraft  instrumentation  systems  often  provide  similar  or  the  same  data  from  a  multitude  of  sources.  Having 
the  ability  to  switch  to  a  pre-identified  backup  source  will  save  time  and  money  by  minimizing  mission 
loss. 

3.8.3  Data  Viewing  Methods  and  Communications 

Once  the  monitoring  requirements  are  defined,  the  next  step  is  to  determine  how  they  will  be  viewed. 
Monitored  parameters  may  be  required  individually,  or  as  a  component  of  a  computed  parameter.  Once  the 
parameters  and  computations  to  be  viewed  are  identified,  then  the  means  to  view  them  should  be 
determined.  There  may  be  many  viewing  options  if  modern  control  room  equipment  is  used,  or  they  may  be 
limited  by  the  capabilities  of  the  control  room.  Modern  control  rooms  offer  both  the  classical  stripchart 
viewing,  as  well  as  computer-generated  displays  for  parameter  viewing. 

When  the  control  room  is  used  for  SOF  or  SOT  monitoring,  careful  attention  must  be  paid  to 
communication.  The  safety  calls,  and  appropriate  actions  as  a  result  of  a  call,  must  be  determined  prior  to 
the  mission,  and  are  usually  a  part  of  the  safety  planning.  All  critical  members  of  the  control  room  crew 
must  be  conversant  as  to  when  to  make  calls,  what  the  calls  should  be,  and  what  the  appropriate  actions  are. 
Since  many  safety  calls  may  be  time  critical,  communications  with  the  aircraft  must  be  considered.  Most 
control-room  procedures  require  a  single  interface,  the  test  conductor,  with  the  test  aircraft.  Calls  are  made 
to  the  test  conductor  by  the  monitoring  personnel  and  then  relayed  to  the  aircraft.  The  intent  is  to  avoid 
confusing  and  conflicting  calls  to  the  aircrew.  Under  some  circumstances,  the  time  criticality  of  a  required 
safety  action  may  dictate  that  the  person  responsible  for  monitoring  the  data  must  have  rapid  and  direct 
access  to  the  aircraft,  by  passing  the  test  conductor.  This  practice  is  common  for  flutter  testing,  where 
critical  actions  must  be  taken  as  rapidly  as  possible  to  avoid  severe  safety  problems.  The  team  must 
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carefully  evaluate  who  can  communicate  with  the  aircraft  and  under  what  conditions  it  can  be  done. 
Multiple  communicators  between  the  control  room  and  the  aircraft  must  be  kept  to  a  minimum. 

3.8.4  Team  Philosophy 

When  a  control  room  is  added  to  a  test  program,  the  ground  crew  monitoring  the  system  and  the  aircrew 
become  an  overall  team.  This  team  can  be  subject  to  the  same  crew  coordination  situations  as  if  they  were 
all  in  the  aircraft.  As  with  any  in-flight  crew  duties,  practice  and  training  are  crucial.  This  is  especially  true 
when  the  monitoring  includes  SOF  or  SOT  duties  where  calls  from  the  ground  station  to  the  pilot  are 
required.  The  team  should  repeatedly  practice  and  review  the  procedures.  An  excellent  way  of  doing  this  is 
by  using  a  ground-based  simulation  in  conjunction  with  a  control  room.  The  simulation  can  then  be  used  to 
practice  and  refine  procedures.  Another  excellent  practice  is  to  confront  the  test  team  with  unexpected 
failures  or  anomalies  during  the  aircraft  simulations.  This  is  a  practice  perfected  by  NASA  during  the 
manned  space  program,  and  is  also  applicable  to  flight  testing.  Time  spent  by  the  team  practicing  with  or 
without  a  simulator  will  greatly  enhance  the  effectiveness  and  safety  of  any  test  program. 

3.9  Simulation  Usage 

3.9.1  General 

Real  time,  6-DOF,  piloted  and  batch  (nonrealtime,  nonpiloted)  simulations  are  invaluable  for  preparing  to 
execute  a  DFCS  flight  test  program.  The  simulation  can  be  used  in  all  aspects  of  the  previously  mentioned 
subject  areas  in  order  to  provide  a  thoroughly  validated  test  plan  and  to  provide  general  team  training  and 
preparation.  The  ability  of  the  simulation  to  aid  in  the  preparation  for  any  flying  qualities  flight  test 
program  is  limited  only  by  the  imagination  of  the  test  team  and  the  fidelity  of  the  simulation.  Simulation 
use  is  irreplaceable  in  designing  a  safe  and  efficient  test  program.  Simulation  can  be  used  to  perform 
analyses  of  critical  flight  regions,  maneuver  design  and  sequencing,  developing  and  practicing  emergency 
procedures,  developing  minimizing  procedures  if  hazards  occur,  and  can  also  aid  in  estimating  the  schedule 
and  cost  for  the  test  program.  This  section  will  outline  some  areas  where  simulation  can  be  used  to  improve 
overall  flight  test  preparation. 

3.9.2  System  Familiarization 

Earlier  sections  of  this  document  have  stressed  the  need  for  a  thorough  and  complete  familiarization  of  the 
overall  predicted  system  operations.  One  of  the  best  ways  to  accomplish  this  is  with  simulation.  Both 
nonreal-time  and  real-time  piloted  simulations  are  invaluable  in  familiarizing  the  engineer  and  pilots  with 
the  intended  system  operation.  Engineers  and  pilots  should  use  the  simulations  to  provide  an  overall 
understanding  of  the  predicted  capability  of  the  aircraft.  Familiarization  with  the  expected  operational 
characteristics  will  be  invaluable  in  planning,  executing,  and  reporting  for  the  flight  test  program. 

One  of  the  best  practices  that  a  DFCS  flight  test  engineer  can  adopt  is  a  regular  schedule  of  personally 
flying  a  simulation.  The  engineer  does  not  need  to  be  a  pilot  or  even  terribly  familiar  with  controlling  an 
aircraft  for  this  to  be  a  valuable  practice.  Sufficient  skills  will  be  developed  during  regular  simulation 
sessions  to  allow  the  engineer  to  adequately  pilot  the  simulation.  These  sessions  can  be  structured  or  simply 
free  time  to  experiment.  Having  the  engineer  fly  the  simulation  not  only  provides  a  better  understanding  of 
the  expected  flight  characteristics  of  the  aircraft,  but  it  also  helps  foster  a  better  understanding  of  the  test 
pilots  job  and  environment  in  which  they  have  to  work.  This  will  improve  communications  between  the 
team  members  during  the  test  program.  Significant  engineer  flying  time  may  be  restricted  by  the  simulation 
schedule  and  cost  of  running  the  simulation;  however,  program  managers  should  try  to  make  time  and 
budget  available  for  the  engineers  to  fly  the  simulator  and  should  encourage  the  practice. 

3.9.3  Flight  Test  and  Safety  Planning 

Simulation  use  (piloted  and  nonpiloted)  is  indispensable  in  designing  a  safe  and  efficient  test  program. 
Simulation  can  be  used  to  perform  analyses  of  critical  flight  regions,  maneuver  design  and  sequencing, 
developing  and  practicing  emergency  procedures,  developing  minimizing  procedures  if  hazards  occur  and 
also  aid  in  estimating  the  schedule  and  cost  for  the  test  program. 
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With  today’s  complex  and  integrated  systems  it  is  impossible  to  thoroughly  test  every  aspect  of  a  given 
system.  By  necessity,  testing  must  be  confined  to  the  most  critical  and  productive  areas.  Critical  areas  are 
those  where  predicted  uncertainty  is  highest,  regions  of  testing  required  to  validate  and/or  update  key 
models,  high  hazard  regions,  and  regions  of  operational  criticality.  Key  parameter  variation  studies  can  be 
conducted  with  the  simulation  in  order  to  better  define  these  regions.  This  information  can  then  be  used  for 
the  test  plan  design,  allowing  the  test  team  to  concentrate  on  testing  the  critical  regions.  Simulation  will  not 
be  the  only  source  for  this  type  of  information,  but  will  be  an  additional  tool  in  the  process.  For  example, 
simulation  is  the  best  place  to  judge  the  sensitivity  to  variations  in  key  aerodynamic  parameters.  When 
combined  with  the  expected  uncertainty  from  the  wind-tunnel  tests  and  past  experience,  regions  of  the 
flight  envelope  that  require  increased  attention  can  be  defined. 

Piloted  simulation  is  also  invaluable  in  developing  and  practicing  test  maneuver  definitions  and 
sequencing.  The  maneuvers  can  be  refined  and  practiced  saving  both  test  time  and  repeat  maneuvers. 
Engineers  as  well  as  pilots  should  participate  in  this  exercise.  Engineers  can  provide  feedback  to  the  pilots 
on  maneuver  quality  as  well  as  add  to  their  understanding  of  how  the  aircraft  is  predicted  to  operate.  Pilots 
can  use  this  feedback  and  their  skills  to  develop  the  most  efficient  manner  for  gathering  the  required 
information.  Hours  spent  in  the  piloted  simulation  practicing  and  developing  the  test  maneuvers  will 
translate  to  time  and  money  saved  during  the  test  program. 

3.9.4  Emergency  Procedures 

Simulation  is  also  the  ideal  place  to  develop  and  practice  emergency  procedures.  Both  the  classical  flight 
manual  procedures  as  well  as  emergency  procedures  for  use  during  the  test  program  can  be  developed  and 
practiced  on  the  simulation.  For  the  test  program,  the  latter  is  probably  of  the  most  benefit.  This  is 
particularly  true  when  a  real-time  control  room  is  in  use  during  the  program.  Practicing  the  procedures, 
calls,  and  responses  with  the  entire  team  in  the  loop  will  greatly  enhance  the  ability  of  the  team  to  handle 
unexpected  anomalies  and  emergencies.  The  theory  is  the  same  as  that  for  requiring  the  aircrew  to  routinely 
practice  emergency  procedures.  In  this  case,  the  control  room  is  as  much  a  part  of  the  aircrew  as  the  pilots 
or  other  on-aircraft  personnel. 

In  order  to  get  the  most  benefit  from  emergency  procedures  simulation  training,  the  piloted  simulation  must 
be  connected  to  the  control  room  or  a  reasonable  replication  of  the  control  room.  The  former  is  the  most 
beneficial,  since  it  also  allows  the  development  and  checkout  of  the  control  room  displays  as  well  as 
minimizing  negative  training  on  nonrepresentative  equipment.  However,  even  if  the  actual  control  room  is 
not  available,  a  reasonable  facsimile  is  still  extremely  useful.  The  degree  of  fidelity  required  for  the 
simulation  control  room  is  dependent  on  the  emergency  procedures  and  the  displays  in  the  actual  control 
room.  If  the  primary  display  in  the  control  room  consists  of  standard  strip  charts,  than  simply  providing 
charts  with  similar  layout  and  scales  in  the  simulation  may  be  sufficient.  Computer  generated  displays  in 
the  control  room  may  provide  additional  requirements  for  the  simulation  displays.  The  test  team  must  make 
a  judgment  on  what  is  the  best  overall  solution  to  practicing  emergency  procedures  using  the  simulation; 
however,  they  should  not  make  the  mistake  of  assuming  that  because  the  fidelity  is  not  100  percent,  that  the 
practice  is  not  worth  the  effort.  Even  relatively  simple  rendition  of  the  actual  control  room  can  have  large 
beneficial  impacts  on  team  emergency  procedure  coordination. 

Another  necessary  tool  for  practicing  emergency  procedures  is  to  have  the  ability  to  insert  failures  into 
the  simulation.  The  failures  and  their  relative  fidelity  depend  on  the  type  of  emergency  procedures 
to  be  practiced.  These  failures  should  be  inserted  unexpectedly  to  surprise  the  test  team  and  aid  in 
developing  proper  crew  coordination  processes  and  procedures.  It  is  almost  guaranteed  that  initial 
procedures  that  have  not  been  practiced  will  change  as  a  result  of  this  process.  Reacting  properly  to 
emergency  conditions  and  failures  depends  on  constant  and  prolonged  training.  Proper  training  of  the  pilots 
and  control  room  teams  using  the  simulation  will  provide  a  significant  increase  in  the  safety  and  efficiency 
of  the  test  program. 
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4.0  FLIGHT  TEST  EXECUTION 

4.1  General 

Flight  test  execution  is  where  all  the  preparation  and  planning  is  finally  put  to  its  intended  purpose.  All  the 
months  and/or  years  of  planning  and  preparation  will  now  either  pay  off  if  they  have  been  well  done,  or 
prove  to  be  a  hindrance  if  not.  The  test  team  should  follow  the  test  plan,  but  not  be  so  inflexible  as  to  ignore 
test  results  and  be  willing  to  modify  the  plan  as  necessary  for  both  test  safety  and  efficiency.  The  actual 
flight  test  execution  phase  should  be  well  dictated  by  the  preparation  and  planning,  including  a  process  to 
update  the  test  plan  as  knowledge  of  the  aircraft  is  gained.  If  the  planning  and  preparation  have  been  well 
accomplished,  than  the  actual  execution  should  be  fairly  smooth,  even  in  the  presence  of  surprises.  This 
section  will  assume  that  the  appropriate  planning  has  been  accomplished,  and  that  the  team  is  following  the 
plan.  The  section  will  primarily  cover  additional  subjects,  which  may  arise  when  executing  the  test  plan. 

In  general,  the  team  should  stick  with  the  test  plan;  however,  surprises  can  be  expected.  This  will  mean  that 
portions  of  the  test  plan  will  need  to  be  modified  as  test  results  become  available.  Modifications  should  be 
accomplished  using  an  established  process.  Modifications  can  be  in  response  to  either  better  or  worse  than 
expected  performance.  Either  case  will  require  the  modification  of  the  original  test  plan. 

Most  DFCS  flight  test  programs  are  an  integrated  effort  covering  technical  areas  outside  of  the  stability, 
control,  and  DFCS  arena.  The  aircraft  envelope  is  normally  being  expanded  for  stability,  control,  handling 
qualities,  loads,  structural  dynamics,  propulsion,  and  systems  operation  simultaneously.  This  requires  a 
disciplined  process  for  coordination  of  all  the  requirements,  concerns,  aircraft  or  systems  limits,  and 
expansion  sequencing  for  all  of  the  technical  areas  of  concern. 

4.2  Test  Plan  Flexibility 

4.2.1  General 

No  matter  how  well  planned  a  DFCS  flight  test  program  is,  a  need  to  modify  the  original  flight  test  plan 
will  arise.  The  initial  test  plan  is  the  result  of  the  best  information  available  at  the  time  of  its  inception.  The 
overall  test  planning  process  needs  to  be  flexible  and  capable  of  reasonable  modification  over  the  life  of  the 
test  program.  As  the  aircraft’s  capabilities  are  discovered  during  the  test  program,  the  initial  test  plan  will 
require  modification.  Modifications  can  range  from  deleting  test  points  to  adding  significant  levels  of  test 
or  retest.  The  test  team  needs  to  establish  a  consistent  procedure  for  defining,  approving,  and  validating  test 
plan  changes.  Without  an  orderly  and  disciplined  procedure,  test  plan  modifications  can  adversely  impact 
both  test  safety  and  efficiency.  A  well-planned  process  for  test  plan  modification  and  updating  needs  to  be 
in  place  prior  to  the  beginning  of  the  test  conduct. 

4.2.2  Major  Test  Plan  Modifications 

Major  test  plan  modifications  need  to  be  conducted  with  all  the  care  and  analysis  of  the  original 
plan.  Modifications  should  be  based  on  detailed  analysis  of  the  actual  flight  data  and  not  hastily  constructed 
between  missions.  Improper  planning  of  major  test  plan  changes  can  rapidly  degenerate  to  at  best  a 
fly-fix-fly  test  program  or  at  worst  a  disaster. 

The  reason  for  a  test  plan  modification  should  be  thoroughly  understood  by  the  test  team.  Test  plan 
modifications  should  undergo  the  same  rigor  as  used  during  the  development  of  the  original  test  plan.  This 
includes  using  all  of  the  knowledge  and  tools  available  to  understand  what  the  new  objectives  may  be,  and 
what  impact  the  redesigned  test  plan  will  have  on  test  safety  and  efficiency.  Major  changes  should  also  be 
accompanied  by  a  formal  safety  review  as  per  the  original  test  plan. 

4.2.3  Minor  Test  Plan  Changes 

Not  every  change  to  the  test  plan  calls  for  a  major  effort  in  exercising  the  modification  process.  Simple 
changes  such  as  repeating  test  points,  adding  minor  buildup  maneuvers,  and  minor  sequencing  changes,  can 
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often  be  accomplished  by  the  test  team  without  major  review.  These  changes  should  be  restricted  to  those 
types  which  do  not  in  any  way  change  the  intent  or  reduce  the  safety  buildup  content  of  the  original  plan. 
They  should  not  consist  of  significant  additional  testing,  which  could  impact  the  test  cost  and  schedule.  The 
limitations  of  allowable  minor  changes  should  be  defined  before  the  actual  test  conduct  begins.  Even  minor 
changes  to  test  planning  should  be  coordinated  throughout  the  test  team  to  ensure  that  nothing  which  may 
impact  other  test  disciplines  is  effected.  These  modifications  need  to  be  carried  out  prior  to  the  mission 
prebriefing.  Test  plan  changes  should  not  be  made  during  the  mission  prebrief. 

4.2.4  Aircraft  Operating  Limits  Process 

The  multiple  engineering  disciplines  involved  in  a  DFCS  flight  test  program  leads  to  the  need  for  an 
integrated  systems  approach  to  the  testing.  Each  discipline  will  likely  have  a  separate  set  of  operating  limits 
and  test  completion  requirements.  These  may  well  be  conflicting  and  require  coordination  in  both  the 
planning  and  execution  phases  of  the  flight  test  program.  In  addition,  the  pressures  from  management  or 
political  sources  may  be  to  fly  as  many  hours  as  possible.  One  way  of  ensuring  that  a  disciplined 
coordination  and  analysis  is  done  is  through  an  expanding  aircraft  operating  limit  (AOL)  process.  The  AOL 
process  sets  intermediate  aircraft  operating  envelopes  for  each  discipline  as  well  as  defining  the  analysis  or 
demonstration  required  to  clear  for  testing  beyond  the  intermediate  envelope.  There  should  be  a  formal 
review  and  sign-off  process  for  expanding  the  intermediate  AOLs  as  the  program  progresses.  The  AOLs 
will  expand  as  the  aircraft  is  properly  cleared  through  appropriate  demonstration  or  analysis  as  defined  by 
technical  requirements  and  not  outside  political  influences.  The  intermediate  envelopes  can  often  be 
established  as  subsets  of  the  envelope  expansion  regions  defined  in  Section  3.  Each  region  can  be 
segmented  into  smaller  regions  based  on  reasonable  subdivision  of  Mach  number,  dynamic  pressure,  AOA 
or  load  factor.  The  AOLs  should  be  divided  into  two  categories.  Category  I  is  the  total  cleared  envelope  to 
date.  This  is  the  envelope  where  other  testing  can  be  accomplished  without  adhering  to  strict  expansion 
procedures.  Category  II  AOLs  are  a  limited  clearance  to  expand  to  broader  envelopes  while  strict 
expansion  procedures  apply.  This  is  actually  a  clearance  to  test  beyond  the  limits  of  the  current  Category  I 
AOL  in  order  to  proceed  with  envelope  expansion.  The  Category  II  AOL  should  be  upgraded  to  a  Category 
I  AOL  when  all  of  the  prerequisite  analysis  and  review  has  indicated  that  the  aircraft  is  capable  of  safely 
operating  within  the  new  expanded  region. 

The  AOLs  should  be  reviewed  by  all  disciplines  involved  in  the  flight  testing.  This  will  minimize  the 
possibility  of  tests  being  conducted  outside  an  appropriate  AOL.  A  last  check  of  the  limits  should  be 
conducted  by  having  all  discipline  leads  review  and  approve  the  mission  test  cards.  This  should  be 
accomplished  prior  to  the  actual  mission  prebriefing  so  that  the  briefing  is  accomplished  with  the  final  test 
cards.  If  significant  anomalies  are  found  during  the  mission  prebriefing,  the  mission  should  be  cancelled 
and  a  review  of  the  mission  test  cards  accomplished.  No  major  test  card  modifications  should  be  made 
during  a  final  mission  prebrief  or  during  the  mission  itself. 

4.2.5  Interrupting  Test  Progression 

Perhaps  one  of  the  most  difficult  choices  to  be  made  during  any  flight  test  program  is  the  decision  to  stop 
testing  pending  further  analysis.  This  is  especially  true  when  the  program  has  been  proceeding  smoothly  to 
date,  and  then  an  anomaly  is  encountered.  The  decision  to  halt  the  expansion  for  further  investigation 
should  be  made  primarily  on  a  technical  basis;  however,  the  decision  to  proceed  should  be  made  on  both 
technical  and  a  risk  versus  benefit  (risk  management)  basis.  The  test  team  should  not  hesitate  to  halt  the 
expansion  if  significant  anomalies  occur.  If  in  doubt,  stop  and  take  a  closer  look  at  the  test  results.  The 
decision  to  proceed  should  then  be  made  after  an  analysis  and  review  of  the  test  results  shows  that  it  is 
prudent  to  proceed.  Decisions  to  interrupt  the  progression  of  the  program  should  be  made  from  a 
conservative  test  safety  point  of  view.  If  test  safety  is  in  doubt  or  unknown,  than  the  assumption  should  be 
made  that  there  is  a  safety  issue,  and  the  program  halted  until  the  issue  can  be  resolved.  It  is  better  to 
assume  a  problem,  take  the  proper  time  to  review  all  of  the  issues  and  then  make  a  decision,  than  to  rush  to 
judgment.  An  error  in  the  first  case  results  in  lost  schedule;  the  error  in  the  latter  could  very  well  lead  to  a 
loss  of  aircraft  or  life. 

The  decision  to  proceed  should  be  made  on  a  risk  versus  benefit  basis.  The  risk  may  well  be  higher  than 
originally  anticipated,  but  the  information  is  sufficiently  critical  to  justify  proceeding.  In  this  case. 
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appropriate  review  of  the  original  test  and  safety  planning  should  be  conducted  to  see  if  modifications  are 
in  order.  Conversely,  the  risk  may  be  higher  than  anticipated,  and  the  information  is  not  sufficiently  critical 
to  justify  proceeding  without  extensive  modifications  to  the  test  planning  or  the  system  design.  Finally,  the 
decision  may  be  that  there  was  no  significant  impact  to  test  safety  in  spite  of  anomalous  behavior,  and  that 
it  is  safe  to  proceed  without  system  or  major  planning  modifications.  These  decisions  should  be  based  on 
knowledge  and  preferably  be  made  on  the  ground  and  not  during  the  pressures  of  an  ongoing  test  mission. 

4.3  Mission  Preparation 

4.3.1  General 

Just  as  important  as  the  initial  test  planning  and  preparation  is  the  individual  preparation  for  each  mission. 
The  mission  preparation  stage  is  where  all  of  the  previous  planning  as  well  as  integration  of  test  results 
comes  together.  Proper  mission  preparation  is  required  for  a  safe  and  efficient  test  program.  Proper 
preparation  for  each  mission  must  include:  a  review  of  previous  tests  accomplished  and  the  results,  a 
definition  of  the  next  set  of  desired  points,  and  proper  coordination  between  all  technical  disciplines 
involved  in  the  test  program.  The  test  team  must  be  disciplined  and  keep  the  goal  of  safe  and  efficient 
achievement  of  the  test  objectives  in  mind.  There  is  often  pressure  to  proceed  with  the  test  program  as 
planned  without  carefully  considering  previous  results.  The  test  team  must  be  capable  of  resisting  this 
pressure  when  warranted,  but  must  balance  this  with  the  need  to  efficiently  conduct  the  test  program. 
The  team  should  not  allow  themselves  to  be  pushed  faster  than  they  are  comfortable  with,  but  must  also  be 
able  to  realistically  determine  risk  versus  benefit. 

4.3.2  Review  of  Past  Tests 

One  of  the  difficult  parts  of  any  active  flight  test  program  is  keeping  up  with  the  data  analyses  in  order  to 
determine  if  the  test  points  flown  to  date  supply  adequate  quality  and  quantity  of  data  as  well  as  to 
determine  if  the  aircraft  is  performing  as  expected.  It  may  seem  that  taking  the  proper  time  to  analyze  test 
results  in  lieu  of  more  flying  is  standing  in  the  way  of  a  rapid  test  program,  particularly  if  no  large  problems 
have  been  encountered  to  date.  In  fact,  just  the  opposite  is  often  true.  Improper  data  analyses  between 
flights  can  lead  to  increased  problems  and  a  slower  and  less  safe  program  as  time  goes  on.  In  addition,  if 
the  data  quality  and  quantity  were  insufficient,  then  it  may  not  be  possible  to  meet  the  flight  test  objectives. 
Test  points  may  be  considered  accomplished;  however,  if  the  data  have  not  been  reviewed,  it  is  not  known 
if  sufficient  data  were  acquired  to  meet  the  objectives. 

The  most  obvious  problem  with  insufficient  analyses  is  being  able  to  spot  potential  problem  areas  before 
they  become  a  significant  threat  to  test  safety.  Early  highlighting  of  potential  problems  allows  for  revised 
test  procedures  or  system  modifications  in  order  to  maintain  safety.  This  can  be  more  efficient  in  the  long 
run  compared  to  waiting  for  a  major  problem  to  occur  prior  to  redesigning  the  test  program  or  system.  In 
addition,  even  if  the  analysis  does  not  adequately  predict  significant  problems,  the  program  is  in  a  much- 
improved  position  to  resolve  those  problems  if  critical  data  analyses  have  been  conducted  in  parallel  with 
the  progress  of  the  test  program.  Program  delays  may  be  minimized  since  a  large  portion  of  the  required 
analyses  have  been  completed.  An  example  of  this  is  the  aerodynamic  model  updating  process.  If  the 
analysts  have  kept  a  reasonable  pace  with  the  test  program  in  updating  the  aerodynamic  models,  than 
designing  the  DFCS  fixes  or  updates  for  mispredicted  aerodynamics  will  happen  much  sooner  than  if  the 
model  updating  must  be  completed  prior  to  defining  a  fix. 

Another  critical  reason  for  keeping  up  with  the  data  analyses  is  to  evaluate  data  quality.  It  does  little  good 
to  find  out  after  all  of  the  flying  is  completed  that  a  key  parameter  for  obtaining  a  test  objective  was  not 
working  properly,  or  that  the  maneuver  quality  was  insufficient.  It  is  much  more  efficient  to  keep  data 
analyses  up  to  date  as  the  test  program  proceeds  in  order  to  define  any  retest  due  to  improper 
instrumentation  or  maneuver  conduct. 

Previously  accomplished  tests,  and  analysis  results  to  date,  must  be  reviewed  as  a  part  of  any  mission 
planning  process.  Failure  to  accomplish  this  can  lead  at  best,  to  embarrassing  situations  where  there  was 
insufficient  data  to  obtain  the  test  objectives,  and  to  the  worst  of  allowing  a  dangerous  situation  to  develop 
that  may  have  been  prevented.  Neglecting  data  analyses  solely  to  expand  the  mission  accomplishment  rate 
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is  neither  an  efficient  or  safe  practice.  This  does  not  mean  that  the  analysis  requirements  can  not  be 
redefined  to  increase  the  mission  rate;  however,  this  should  only  be  done  after  a  thorough  review  of  the 
technical  impacts  of  decreasing  the  analysis  required  between  flights. 

4.3.3  Test  Cards 

Flight  test  cards  are  the  means  by  which  the  test  team  orders  the  sequencing  of  the  testing  and  provides 
information  critical  to  the  conduct  of  the  test.  Card  formatting  and  the  information  are  critical  to  both 
the  efficiency  and  safety  of  the  flight  test.  There  is  no  single  format  for  test  cards;  however,  all  should 
present  information  in  a  straightforward,  consistent,  and  logical  manner.  Many  flight  test  organizations 
have  detailed  and  specific  instructions  pertaining  to  card  format  and  information  to  be  included.  This 
is  an  excellent  practice  and  ensures  some  level  of  test  card  uniformity  between  test  programs  within 
the  organization. 

Test  cards  should  contain  information  on  the  test  condition,  any  specific  configuration  required, 
test  maneuvers,  and  any  key  limits  relative  to  the  tests  being  conducted  with  that  card.  The  first  card 
or  cards  usually  contain  mission  specific  information  such  as  test  ranges  to  be  used,  mission  frequencies, 
mission  overview,  and  aircraft  health.  The  test  condition  usually  applies  to  the  whole  card  (e.g., 
Mach  number  and  altitude).  The  configuration  would  include  such  things  as  aircraft  physical  configuration, 
(e.g.,  gear  flaps,  loading,  and  eg),  as  well  as  information  on  any  systems  or  subsystems  configurations.  The 
test  maneuvers  should  be  laid  out  in  sequence  of  performance  and  indicate  any  requirements  such  as  trim  or 
retrim  prior  to  maneuver  execution.  Any  pertinent  limits  such  as  AOA,  angle  of  sideslip  (AOS),  or  load 
factor,  for  a  given  maneuver  should  also  be  indicated. 

One  of  the  most  common  mistakes  in  test  card  design  is  trying  to  overload  the  card  with  too  much 
information.  Too  much  information  can  clutter  the  presentation  and  make  the  cards  difficult  to  read.  The 
test  pilot  will  be  trying  to  read  the  test  card  as  well  as  fly  the  aircraft.  Cards  with  too  much  information  or 
very  small  print  will  make  this  job  more  difficult  and  can  impact  test  efficiency  and  safety.  Test  cards  are 
also  used  by  the  test  conductor  and  control  room  personnel  to  direct  or  monitor  the  progression  of  the 
testing.  These  individuals  should  have  the  same  information  as  presented  to  the  pilot,  although  the  cards  are 
often  printed  with  more  space  for  note  taking. 

4.3.4  Mission  Prebrief 

The  mission  prebrief  is  an  essential  part  of  any  DFCS  test  program,  a  part  that  should  never  be  skipped  or 
minimized.  The  prebrief  is  not  only  a  coordination  meeting  for  the  whole  team  to  review  the  mission;  it  is 
also  a  last  chance  to  catch  any  errors  in  the  planned  mission.  The  prebrief  is  where  all  of  the  pertinent 
information  concerning  the  upcoming  mission  is  presented,  discussed,  and  reviewed  by  all  involved.  All 
aircrew  and  control  room  personnel  involved  in  the  mission  should  be  at  the  prebrief.  Briefed  items  should 
include:  a  mission  overview,  a  review  of  any  special  mission  assets  required,  an  in-depth  review  and 
discussion  of  each  test  point  and  maneuver,  a  review  of  the  pertinent  test  safety  hazards  for  that  mission, 
and  a  review  of  the  applicable  emergency  procedures  for  that  mission. 

Major  test  plan  or  mission  modifications  should  not  be  accomplished  during  the  prebrief.  Intended  mission 
objectives  and  procedures  should  be  coordinated  prior  to  the  prebrief.  If  major  mission  redefinition  is  called 
for  as  a  result  of  the  prebrief,  the  mission  should  be  cancelled  until  the  proper  coordination  has  been 
accomplished.  This  does  not  mean  that  minor  corrections  of  clarifications  can  not  be  made  during  the 
prebrief.  The  distinction  between  a  major  modification  and  a  minor  one  is  best  judged  by  the  experienced 
members  of  the  test  team. 

4.4  Mission  Conduct 
4.4.1  General 

Most  of  the  DFCS  test  team’s  participation  during  a  test  mission  will  be  either  on  the  ground  in  a  control 
room  or  in-flight  monitoring  on  a  larger  aircraft.  Whether  the  mission  is  being  controlled  or  monitored  from 
a  ground  or  in-flight  control  room,  the  entire  team  participating  the  monitoring  becomes  part  of  the  aircrew. 
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As  such,  they  have  an  obligation  to  conduct  themselves  and  their  jobs  in  the  same  professional  and 
disciplined  manner  as  a  normal  on-board  aircrew. 

4.4.2  Control  Room  Procedures  and  Protocol 

The  protocol  in  any  control  room  (whether  on  ground  or  airborne)  should  be  as  strict  as  that  for  the 
test  pilots.  The  test  monitor’s  job  is  to  continuously  evaluate  the  aircraft  or  systems  response  for  both 
data  quality  and  safety  implications.  When  either  of  these  are  compromised,  they  must  then  communicate 
the  required  actions  to  the  test  conductor  and  aircrew.  This  job  requires  knowledge  of  the  parameters 
and  system  being  monitored,  concentration  on  what  is  happening  to  both  the  individual  system  and  on 
the  mission  (situational  awareness),  and  familiarity  with  actions  and  procedures  to  be  used  when 
the  situation  requires. 

Because  monitoring  requires  concentration  and  mission  situational  awareness,  anything  in  the  control  room 
such  as  idle  conversation,  nonmission  related  reading,  or  anything  else  which  is  potentially  distracting, 
must  be  strictly  controlled.  The  basic  rule  should  be  that  unless  it  is  mission  related,  do  not  talk  or  visit; 
instead,  the  test  team  should  continuously  monitor  their  station  for  both  safety  and  data  quality.  When 
mission-related  communication  is  required,  then  it  should  be  done  in  the  defined  and  prescribed  fashion, 
which  was  developed  before  the  mission. 

Each  control  room  monitor  is  responsible  for  knowing  their  role  and  any  specific  actions  or  safety  calls 
they  are  required  to  perform.  They  should  be  thoroughly  familiar  with  all  of  their  assigned  duties.  One 
method  for  reviewing  and  ensuring  these  capabilities  is  through  some  form  of  situational  testing  before  the 
missions  and/or  during  the  mission  prebriefing.  On  a  recent  AFFTC  high  AOA  test  program,  this  was 
accomplished  during  the  prebrief  (as  well  as  with  continual  simulation  practice).  The  test  conductor  would 
come  to  the  brief  prepared  with  specific  emergency  scenarios.  The  scenario  would  be  described,  than  each 
member  of  the  test  team  quizzed  as  to  the  appropriate  actions  or  calls.  This  turned  out  to  be  an  extremely 
beneficial  and  efficient  method  for  ensuring  that  all  kept  up  on  their  assigned  duties  in  the  control  room  and 
on  the  aircraft. 

Visitors  to  the  control  room  are  undesirable,  but  unavoidable.  If  they  are  to  be  within  the  control  room 
itself,  they  must  be  thoroughly  briefed  on  acceptable  behavior  and  not  to  interfere  with  the  mission.  It  is 
preferable  that  if  a  test  program  is  aware  that  there  will  be  continual  visitors  to  the  control  room,  then 
separate  facilities  should  be  provided  where  visitors  can  not  interfere  with  the  conduct  of  the  mission. 
Visitors  should  not  be  allowed  to  have  any  input  into  the  mission  itself  while  underway.  Modifications  by 
visitors  to  the  planned  test  or  emergency  procedures  should  not  be  allowed.  The  test  conductor  or  director 
should  have  the  authority  to  have  any  visitor  violating  these  basic  rules  removed  from  the  control  room, 
regardless  of  their  rank  or  position. 

Basic  mission  rules  should  be  adhered  to  at  all  times  and  no  modifications  should  be  made  while  the  flight 
is  ongoing.  Significant  discrepancies  or  disagreements  should  result  in  mission  termination  and  subsequent 
resolution  on  the  ground.  Arguments  and  unresolved  action  have  no  place  in  a  flight  test  mission  control 
scenario  and  must  be  avoided.  It  the  responsibility  of  the  test  conductor  (or  director)  to  maintain  control 
room  procedure  and  decorum  at  all  times. 

4.5  Postmission 
4.5.1  General 

The  events  immediately  following  the  mission  can  have  as  much  impact  on  test  efficiency  and  safety 
as  those  dming  planning  and  conduct.  Proper  mission  debriefing  and  data  analyses  can  significantly 
increase  both  test  efficiency  and  safety.  Poor  postmission  execution  can  and  will  adversely  impact  the 
overall  test  program. 
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4.5.2  Postflight  Debriefing 

The  postflight  debriefing  is  where  all  of  the  events  during  the  mission  are  reviewed.  Pilot  mission  conduct, 
planning,  and  control  room  comments  are  all  appropriate  subjects  for  the  postflight  debrief.  The  debrief 
should  start  with  an  overview  of  any  significant  mission  events,  followed  by  a  detailed  test  card  by  test  card 
review.  Any  anomalies  in  the  aircraft  operation  should  be  discussed  and  reviewed.  Unique  actions  to  be 
performed  (other  than  normal  planned  interflight  activities)  prior  to  the  next  mission  should  be  defined. 
Any  test  points  which  require  test  based  on  mission  results  should  be  defined.  Detailed  pilot  comments  and 
handling  qualities  ratings  are  also  reviewed  and  finalized  at  the  postflight  debrief.  Pilot  impressions  on 
system  performance  are  recorded. 

Following  the  debrief,  an  initial  mission  report  is  usually  prepared  by  the  test  conductor  and  pilot.  This 
report  summarizes  the  mission  and  critical  information  from  the  debrief.  Test  points  accomplished,  mission 
problems,  system  problems,  and  pilot  comments  are  documented  in  the  mission  report.  This  report  should 
be  completed  within  24  hours  after  the  mission.  These  documents  are  absolutely  necessary  in  order  to 
record  the  progress  and  preliminary  test  results  during  the  course  of  the  test  program.  They  will  also 
become  invaluable  when  preparing  the  final  flight  test  program  report,  sometimes  years  after  mission 
occurrence.  Mission  reports  will  be  one  of  the  primary  data  sources  for  the  final  report.  Failure  to  maintain 
mission  reporting  within  a  reasonable  timeframe  of  the  mission  occurrence  will  result  in  the  loss  of 
valuable  test  program  information.  As  time  goes  by  and  other  missions  are  accomplished,  detailed 
information  on  any  particular  mission  will  be  lost  without  these  reports.  The  lack  of  a  strict  mission 
reporting  policy  or  process  is  an  indication  of  a  poorly  run  test  program,  and  one  that  may  also  have 
efficiency  and  safety  problems. 

4.5.3  Model  Updating 

The  model  updating  process  should  proceed  in  parallel  with  the  envelope  expansion.  Experience  has  shown 
that  this  is  the  best  way  to  apply  the  predict,  test,  update,  and  validate  test  philosophy.  The  advantages  of 
keeping  the  models  updated  are: 

a.  Understanding  why  the  aircraft  is  operating  as  it  is, 

b.  Having  the  best  models  available  to  analyze  anomalies,  and 

c.  Having  the  most  knowledge  possible  about  the  aircraft  from  which  to  make  informed  decisions. 

Keeping  the  models  updated  in  parallel  with  the  expansion  requires  dedicated  manpower  and  significant 
planning.  Many  programs  start  out  with  every  intention  of  applying  this  process,  but  rapidly  revert  to  a 
fly-fix-fly  operation.  One  of  the  main  reasons  for  this  occurring  is  improper  planning  early  in  the  test 
program.  Programs  often  underestimate  the  resources  required  to  update  the  model.  Early  planning  for 
resources,  techniques,  and  tools  are  required  in  order  for  parallel  model  updating  to  succeed. 

When  the  models  are  kept  updated,  the  test  team  is  in  the  best  position  to  understand  differences  between 
predictions  and  actual  system  operation.  The  most  efficient  and  safe  way  to  make  the  necessary  technical 
programmatic  decisions  is  when  those  decisions  are  based  on  knowledge  rather  than  supposition.  One 
of  the  best  ways  to  gain  this  knowledge  is  to  use  simulation  combined  with  updated  models.  For  DFCS 
and  flying  qualities  test  programs,  the  model  that  usually  requires  the  most  attention  is  the  aerodynamic 
model.  Fortunately,  time  demonstrated  techniques  are  available  for  identifying  key  aerodynamic  parameters 
from  the  test  results.  Similar  techniques  can  sometimes  be  applied  to  the  other  models,  but  often  are  not. 
This  may  change,  as  simulation  becomes  a  more  integral  part  of  flight  testing  in  the  future  for  a  broad  range 
of  disciplines.  The  same  philosophies  used  for  updating  the  aerodynamic  model  would  be  applicable  to 
other  disciplines. 

A  dedicated  team  should  be  used  to  analyze  the  test  data,  develop  the  flight-derived  parameters  and  update 
the  models.  This  team’s  sole  responsibility  should  be  updating  the  models  from  flight  test  results.  The 
update  team  must  be  familiar  with  the  form  of  the  predicted  models,  potential  uncertainty  areas,  planned 
update  algorithmic  forms  and  various  parameter  identification  methodologies.  The  team  leader  should  have 


46 


prior  experience  in  updating  models  based  on  flight  test  data.  Updating  models  can  be  as  much  of  an  art  as 
a  science;  therefore,  the  experience  of  the  updating  team  will  have  a  direct  impact  on  the  success  and 
timelines  of  the  effort. 

The  basic  form  of  the  most  likely  updates  should  be  defined  prior  to  the  beginning  of  the  flight  portion  of 
the  test  program.  An  excellent  arena  for  accomplishing  this  would  be  during  parameter  variation  studies. 
There  will  always  be  a  need  to  modify  the  form  of  the  updates  as  not  all  variations  can  be  postulated. 
However,  developing  a  basic  mechanism  within  the  model  to  accomplish  these  updates  will  greatly 
simplify  the  task  during  the  test  portion  of  the  program.  As  an  example,  basic  aerodynamic  tables  that  add 
variations  to  the  basic  force  and  moment  coefficients  can  be  added  to  the  model.  These  tables  will  usually 
be  a  function  of  the  key  aerodynamic  independent  variables  such  as  Mach  number,  AOA,  dynamic 
pressure,  sideslip,  and  surface  position.  The  tables  are  initially  filled  with  zeros,  and  modified,  as  data 
become  available.  This  method  has  been  successfully  used  on  several  test  programs. 

4.6  Simulation  Use 

4.6.1  General 

Use  of  simulation  during  the  test  execution  phase  is  just  as  important  as  during  the  preparation  and 
planning  phase.  The  simulation  can  be  used  to  provide  detailed  mission  planning,  emergency  procedure 
training,  predicted  results,  and  aid  in  data  analyses  as  well  as  anomaly  resolution.  The  range  of  usefulness 
of  simulation  during  the  execution  of  the  test  program  is  only  limited  by  the  ingenuity  of  the  test  team. 
The  use  of  simulation  allows  an  understanding  of  how  the  system  is  supposed  to  operate,  and  why,  as 
well  as  an  understanding  of  how  the  system  is  actually  operating  and  why.  When  system  operation 
(both  expected  and  actual)  is  well  understood,  then  more  informed  decisions  can  be  made  relative  to 
test  execution. 

4.6.2  Mission  Training 

Preflying  missions  or  portions  of  a  mission  on  the  manned  simulation  can  help  to  increase  the  efficiency 
and  safety  of  the  testing.  Once  the  initial  flight  test  mission  cards  are  prepared,  the  intended  execution 
sequence  can  be  evaluated  on  the  simulation.  Test  point  or  maneuver  sequencing,  not  specifically  ordered 
for  safety  or  buildup,  can  be  evaluated  to  ensure  that  the  most  efficient  sequence  is  used  to  maximize  the 
amount  of  data  acquired  for  a  given  mission.  In  addition,  the  maneuvers  can  be  practiced  in  order  to  gain 
proficiency  in  maneuver  execution  thereby  reducing  the  amount  of  repeat  points  during  the  mission.  The 
test  team  that  will  be  monitoring  the  mission  in  the  control  room,  should  participate  in  the  mission 
simulation  sessions  in  order  to  gain  knowledge  on  what  the  expected  aircraft  response  is.  This  will  allow 
the  monitors  to  more  readily  assess  the  vehicle  performance  during  the  mission. 

Continual  emergency  procedures  training  are  also  a  valuable  use  of  simulation  during  the  test  execution 
phase.  This  not  only  applies  to  the  pilots,  but  also  to  the  control  room  monitors.  Unexpected  failures  or 
aircraft  response  should  be  incorporated  into  the  simulation,  and  the  pilot  and/or  control  room  responses 
exercised.  This  should  be  accomplished  on  some  regular  schedule  in  order  to  maintain  team  proficiency. 

4.6.3  Data  Analyses 

The  simulation  can  be  an  invaluable  tool  to  aid  in  analyzing  the  test  data.  The  analysis  can  be  enhanced 
with  a  broad  range  of  simulation  capability,  from  nonreal-time  batch  simulations  to  full  man-in-the-loop 
simulation.  Comparisons  can  be  made  on  a  real-time  or  near  real-time  basis  as  the  mission  is  progressing, 
as  well  as  postflight.  Most  envelope  expansion  programs  will  use  a  reasonable  combination  of  premission 
predictions  combined  with  more  detailed  postflight  comparison.  Modern  computer  capacity  has  also 
allowed  for  the  real-time  or  near-real-time  comparison  of  simulation  and  flight  results  in  the  control  room. 
The  analysis  can  be  even  more  productive  if  the  models  used  (particularly  the  aerodynamic  model)  are  kept 
updated  from  flight  test  results  as  the  program  progresses.  Perhaps  one  of  the  most  beneficial  analyses  is  a 
direct  comparison  of  the  flight  and  simulation  results.  This  can  be  a  comparison  of  summarized  data  such 
as  frequency  and  damping,  and  maximum  rates,  or  more  complex  such  as  driving  the  simulation  with  flight 
measured  inputs.  The  former  is  used  when  the  test  team  does  not  have  direct  access  to  a  simulation  at  the 
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test  site  and  must  accumulate  predicted  data  from  planned  off-site  simulation  sessions.  The  latter  can  give 
a  direct  time-history  comparison  between  the  predicted  simulation  response  and  the  actual  aircraft  motion. 
Simulation  and  test  data  overplots  are  a  more  direct  comparison  method,  but  also  more  complex  in  that 
special  implementation  considerations  (trim,  integration  drift,  and  nonstandard  atmosphere)  must  be 
in  place  in  order  to  drive  the  simulation  with  flight  measured  inputs.  The  time-history  comparison  is  only 
as  good  as  the  models  used  in  the  simulation.  Poor  models,  or  incorrectly  updated  models  can  result 
in  poor  comparisons. 

4.6.4  Anomaly  Investigation 

The  simulation  is  also  valuable  in  anomaly  investigation.  The  same  simulation  types  used  for  data  analyses 
can  also  be  used  for  anomaly  investigation.  In  addition,  subsets  or  simulations  of  particular  portions  of  the 
system  can  also  be  driven  with  flight  measured  test  data  to  isolate  problems.  Using  the  simulation  to 
analyze  flight  anomalies  allows  for  an  understanding  of  the  anomaly  and  as  such,  can  lead  to  solutions.  An 
example  of  this  is  available  from  the  X-29  program.  The  X-29  DFCS  control  laws  used  a  simplified  model 
of  the  flaperon  actuators  for  RM.  The  RM  would  declare  the  actuator  failed  when  the  model  output 
exceeded  the  actual  output  by  a  predefined  margin.  A  failure  was  declared  by  this  monitor  during  the  high 
AOA  envelope  expansion  when  a  high  frequency  tail  buffet  entered  the  control  laws  via  the  roll  rate 
feedback  channel.  The  simplified  actuator  model  used  by  the  RM  system  could  not  accurately  predict 
actuator  motion  imparted  by  the  buffet,  and  hence  a  failure  was  declared.  The  real-time  indication  was  of  a 
failing  servo,  and  the  reason  was  not  readily  apparent.  The  cause  of  the  declared  failure  was  discovered  by 
driving  an  offline  simulation  of  the  RM  algorithm  with  the  flight  measured  actuator  commands.  The  failure 
of  the  simplified  model  to  accurately  predict  the  actuator  motion  was  readily  evident,  and  a  redesigned 
model  was  developed  and  validated  with  the  flight  measured  data.  The  redesigned  model  was  then 
successfully  tested  on  the  aircraft. 

5.0  DATA  ANALYSES 

5.1  General 

As  with  most  other  aspects  of  developing  a  DFCS  flight  test  program,  early  involvement  in  data  processing 
is  a  must.  The  test  objectives  will  drive  the  data  requirements  to  satisfy  the  objectives.  In  turn,  the  needed 
results  will  define  the  data  analyses  techniques  and  instrumentation  requirements.  This  section  will  cover 
some  of  the  basic  data  analyses  techniques  often  used  in  DFCS  flight  test  analyses. 

5.2  Data  Errors  and  Corrections 

5.2.1  General 

Much  of  the  raw  data  collected  from  the  test  aircraft  will  require  corrections  in  order  to  evaluate  the 
true  value.  The  corrections  are  often  a  consequence  of  the  environmental  characteristics  in  which  the 
sensors  operate.  The  environmental  factors  can  include  such  things  as  local  aerodynamic  flow,  off  eg 
measurements,  structural  vibrations,  and  instrumentation  noise  contamination.  Consideration  of  the  proper 
corrections  must  be  included  in  any  analysis.  Failure  to  do  so  can  often  lead  to  erroneous  and  misleading 
analyses  and  evaluations. 

5.2.2  Air  Data 

Airspeed  and  altitude  are  often  measured  from  several  sources  during  a  flight  test  program.  The  aircraft 
may  be  equipped  with  a  specialized  nose  or  wingtip  boom  containing  a  separate  Pitot-static  source  for 
determining  airspeeds  and  pressure  altitude.  This  boom  may  be  in  addition  to  a  production  system 
measuring  similar  data,  but  at  a  different  location  on  the  aircraft.  Data  from  both  must  be  corrected  for 
position  error,  total  pressure  loss,  and  total  temperature  corrections.  The  nose  or  wingtip  boom  is  often  used 
during  a  test  program  since  in  theory  it  will  have  lower  position  error  corrections  due  to  placement  of  the 
Pitot  and  static  sensors  away  from  the  aircraft  flow  field.  Boom  systems  still  require  calibration  in  order  to 
obtain  the  true  values  of  airspeed,  Mach  number  and  pressure  altitude.  However,  the  smaller  corrections 
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(compared  to  a  production  system)  provide  data  with  less  uncertainty  than  applying  the  same  techniques  to 
the  production  system.  The  corrected  values  from  the  boom  data  are  then  used  to  calibrate  the  production 
system.  Most  modem  aircraft  utilizing  digital  control  systems  will  have  an  onboard  air  data  computer 
(ADC)  which  will  take  the  production  measured  values  and  apply  appropriate  corrections.  Predicted 
corrections  may  or  may  not  be  available  before  first  flight.  The  DFCS  flight  test  team  must  be  aware  that 
any  air  data  scheduled  gains  in  the  flight  control  system  will  be  selected  based  on  whatever  the  indicated 
output  of  the  ADC  is.  This  will  not  be  the  same  as  the  true  air  data  parameters  until  flight  test  generated 
corrections  are  obtained  and  implemented  in  the  ADC.  If  no  ADC  or  other  correction  source  for  the  control 
laws  is  available,  then  the  flight  control  system  will  be  operating  on  different  air  data  than  the  true  values. 
This  could  impact  the  analysis  of  the  flight  data  and  also  implies  that  the  air-data  parameters  being  used 
by  the  control  laws  should  be  an  instrumented  parameter. 

Position  error  flight  testing  and  error  determination  is  a  complex  subject  beyond  the  scope  of  this 
document.  Reference  5  ( Standard  Airspeed  Calibration  Procedures )  contains  an  excellent  compilation  of 
the  classical  position  error  determination  techniques.  Many  of  the  older  techniques,  which  are  based  on 
measuring  speed  and  altitude  relative  to  a  known  point,  are  being  replaced  with  global  positioning  system 
(GPS)  methodologies.  For  low  altitude,  subsonic  position  error  methods  the  classic  tower-fly-by  or 
measured  ground-course  techniques  are  often  used.  For  higher  altitude  and  supersonic  flight,  pacer  aircraft, 
inertial  navigation  system  (INS),  or  radar  methods  can  be  used.  Again,  more  modern  techniques  are 
beginning  to  use  GPS  as  a  reference  measurement  source  for  position  error.  Ground  course,  INS,  and  GPS 
methods  give  earth-referenced  velocities,  altitudes  and  positions.  They  do  not  directly  account  for  winds  or 
off  standard  day  temperature  profiles.  Special  flight  test  techniques  and  data  analyses  can  be  used  to 
account  for  not  considering  the  winds  or  off  standard  day  temperature  profiles.  If  neither  are  considered, 
the  data  can  be  grossly  in  error.  The  tower-fly-by  and  pacer  aircraft  methods  avoid  these  problems  and 
provide  a  more  direct  measurement  of  the  errors  than  do  the  radar,  GPS,  INS,  or  ground  course  methods. 
However,  these  methods  can  also  be  more  expensive  and  time  consuming. 

Understanding  basic  Pitot-static  systems  requires  knowledge  of  the  standard  atmosphere  models,  the  real 
atmosphere  and  how  the  Pitot-static  systems  work.  Standard  atmosphere  models  do  not  exist  in  reality,  it  is 
simply  an  average  of  measured  atmospheric  parameters  over  time.  Chances  are  slim  that  any  flight  test 
program  will  ever  be  conducted  where  a  standard  day  actually  exists  across  the  altitude  envelope.  One  area 
often  misunderstood  is  the  relationship  between  true  or  tapeline  altitude  (the  actual  altitude  above  Mean 
Sea  Level)  and  pressure  altitude  (the  pressure  for  a  given  geopotential  altitude  on  a  standard  day). 
A  constant  correlation  is  only  available  for  standard  day  conditions,  which  almost  never  exist.  Attempts  to 
compare  a  direct  tapeline  measurement  (such  as  with  GPS)  to  a  given  pressure  altitude  are  only  valid  for 
the  test  day  pressure  and  temperature  profiles  with  altitude.  There  can  be  differences  ranging  from  tens  to 
several  thousand  feet  between  pressure  and  tapeline  altitudes  with  nonstandard  day  conditions. 
A  comparison  between  the  two  cannot  be  made  without  knowledge  of  these  profiles.  Another  area  often 
misunderstood  is  the  relationship  between  airspeeds  and  inertial  speeds.  Airspeeds  are  measured  with 
respect  to  the  local  atmosphere  and  hence  include  winds.  Inertial  speeds  are  measured  with  respect  to  some 
fixed  datum  (typically  the  surface  of  the  earth)  and  do  not  include  winds.  The  difference  between  the  two 
can  be  as  large  as  several  hundred  knots,  depending  on  the  local  atmospheric  conditions. 

5.2.3  Accelerometer  Corrections  for  Off  Cg  Measurement 

Accelerometers  are  almost  never  located  at  the  aircraft  cg.  Corrections  to  the  measured  values  must  be 
applied  to  get  the  cg  value  of  acceleration.  The  corrections  can  be  large,  depending  on  the  location  of  the 
sensors  and  the  level  of  aircraft  maneuvering.  Using  the  raw  measured  values  as  cg  value  without  proper 
corrections  can  result  in  large  errors.  The  following  equations  show  the  appropriate  corrections  to  transfer 
the  measured  accelerations  to  the  cg. 
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Nxcg  =  Nx measured  +  ^  (?2  +  r2  )  +  ^  (r  -  M)  -  ^  (q  +  pr) 
Nycg  =  Ny measured  +  ^(p2  +  r2  )  +  A  (p  -  r^)  -  ^  (r  +  pq) 

o  o  o 

Nzcg=  ^measured  -lf(q2  +  P2)~l-f(q- pr)  +  ^(p  + qr) 

o  o  o 


where: 

/VxC£  =  CG  va/t/e  of  x  body  axis  load  factor,  g's 
Nycg  =  CG  value  of  y  body  axis  load  factor,  g's 
Nzcg  =  CG  value  of  -  z  body  axis  load  factor,  g's 
Nx measured  =  measured  value  of  x  body  axis  load  factor,  g's 
Ny  measured  =  measured  value  of  y  body  axis  load  factor,  g's 
Nz measured  =  measured  value  of  -  z  body  axis  load  factor,  g's 
lx,ly,lz  =  body  axis  location  of  accels  relative  to  eg, 
p,q,r  =  body  axis  angular  rates,  and 
g  =  acceleration  due  to  gravity. 

The  corrections  are  a  function  of  the  relative  distance  between  the  sensor  and  the  aircraft  eg  (in  body  axis 
coordinates),  the  body  axis  angular  rates  and  the  body  axis  angular  accelerations.  Sensor  location  relative  to 
the  aircraft  eg,  measured  accelerations,  and  body  axis  rates  are  common  data  from  any  flight  test  program. 
However,  angular  accelerometers  are  not  common  and  often  undesirable  due  to  noise  characteristics. 
The  angular  accelerations  used  in  the  above  corrections  are  most  often  obtained  by  digitally  differentiating 
the  angular  rates. 

5.2.4  Vane  Measured  Angle-of-Attack  and  Sideslip  Corrections 

Vane  measured  AOA  and  sideslip  has  several  error  sources  that  must  be  accounted  for.  These  errors  are 
upwash,  sidewash,  structural  flexibility,  axis  alignment,  and  rotational  rate  induced  angles.  Upwash  and 
sidewash  affect  the  AOA  and  sideslip  vanes  due  to  local  flow  about  the  aircraft.  Structural  flexibility  arises 
from  the  fact  that  the  aircraft  will  bend  under  varying  flight  conditions.  Axis  misalignment  is  a  calibration 
and  sideslip  plane  of  measurement  problem.  The  induced  angles  are  a  result  of  induced  local  velocities  at 
the  vane  locations  due  to  solid  body  rotation,  which  in  turn  result  in  angle  measurement  errors. 

For  noseboom  mounted  vane  installations,  upwash  is  primarily  a  function  of  the  lift  of  the  wing  and 
location  relative  to  the  wing.  Wingtip  boom  vane  installations  have  a  similar  phenomena,  but  tend  to  have 
higher  values  of  upwash,  compared  to  a  noseboom,  due  to  their  proximity  to  the  wing  vortex  system. 
Wingtip  boom  AOA  vanes  can  also  have  complex  upwash  characteristics  due  to  the  wingtip  vortex. 
Forward  fuselage  mounted  vanes  have  the  influence  of  the  wing's  vortex  system  and  are  also  heavily 
influenced  by  the  local  flow  characteristics  about  the  aircraft’s  nose.  Upwash  values  typically  range  from 
10  to  15  percent  for  a  far  forward  located  noseboom  to  as  much  as  30  to  40  percent  for  fuselage  mounted 
vanes.  Reference  5  gives  classical  flight  test  techniques  for  calibrating  the  AOA  vanes  for  upwash.  In 
addition,  trajectory  reconstruction  techniques  can  also  be  used  to  estimate  the  upwash  corrections. 

Sidewash  on  a  classical  noseboom  installation  is  often  close  to  zero  due  to  the  lack  of  a  significant  lateral- 
directional  flow  field  as  strong  as  the  lifting  vortex  in  the  longitudinal  plane.  Typical  values  for  this  type  of 
installation  may  range  from  0  to  10  percent.  However,  for  nose  or  nose  chin  vane  installations,  sidewash 
can  easily  be  as  much  as  50  percent  and  nonlinear  with  indicated  sideslip.  Sideslip  measured  from  wingtip 
mounted  installations  can  also  be  heavily  influenced  by  the  wingtip  vortex.  The  literature  is  bereft  of  flight 
test  techniques  for  calibration  of  a  sideslip  vane.  Techniques  similar  to  the  classical  calibration  techniques 
for  the  AOA  vane  do  not  typically  work  due  to  the  difference  in  physics  between  longitudinal  and  lateral 
directional  flight  mechanics.  Typically,  sidewash  calibrations  have  been  assumed  to  be  zero.  This  is  not  a 
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bad  estimation  for  the  classical  noseboom  installation,  but  as  already  indicated,  can  drastically  be  in  error  if 
using  a  chin  or  a  wingtip  mounted  vane.  However,  the  advent  of  modern  trajectory  reconstruction 
techniques  has  made  the  estimation  of  sidewash  a  tractable  problem.  The  author  has  had  excellent  success 
in  calibrating  both  noseboom  and  chin  mounted  sideslip  vanes  with  trajectory  reconstruction  techniques. 

In  order  to  fully  understand  the  induced  angle  corrections,  the  true  definition  of  AOA  and  sideslip  is 
necessary.  The  angles  are  defined  in  Figure  15.  The  AOA  is  the  angle  between  the  X  body  axis  and  the 
projection  of  the  free  stream  true  velocity  vector  upon  the  X-Z  body  plane.  Sideslip  is  the  angle  between 
the  free  stream  velocity  vector  and  the  X-Z  body  plane.  Both  are  measured  relative  to  the  aircraft  center  of 
gravity.  The  true  definition  of  sideslip  is  often  misunderstood.  Sideslip  is  often  improperly  defined  as  the 
angle  between  the  free  stream  velocity  vector  and  the  X  body  axis.  This  is  an  incorrect  definition  and  can 
cause  large  data  analyses  errors  if  improperly  applied. 

The  vane -measured  angles  are  not  taken  at  the  eg,  which  means  that  velocities  due  to  body  axis  rotation 
will  induce  angles  at  the  vane’s  location.  The  local  velocities  at  the  eg  and  at  the  vane  location  will  be 
different  as  shown  if  Figure  16. 


Figure  15  True  Angle-of- Attack  and  Angle-of-Sideslip  Definitions 


Figure  16  Vane  Measured  Angles 

The  angular  rate  corrections  to  vane  measured  angles  can  be  derived  as  follows: 
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where: 


Q 

R 

X 

Ucg 

U  vnne 

Vcg 

V  vane 

w„ 


[p  q  r]T;  body  axis  angular  rates, 

[lx  ly  1Z]T;  vane  location  relative  to  eg  in  body  axis, 

cross  product  operator, 

X  body  axis  velocity  at  the  eg, 

X  body  axis  velocity  at  the  eg, 

Y  body  axis  velocity  at  the  eg, 

Y  body  axis  velocity  at  the  eg, 

Z  body  axis  velocity  at  the  eg,  and 
Z  body  axis  velocity  at  the  eg. 


By  definition; 


Tan(avane ) 
Tan(f5vane ) 


Wyane 

Uvane 
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UCg  —  VtrueC  OS  ( ptrue)  COS(  a,me) 

vcg  =  VtrueSIN(J3true) 

wcg  =  VtmeC  OS  ( P,me)SIN ( atrue) 

where: 


amne  =  vane  measured  angel  of  attack, 
atme  =  true  angle  of  attack, 

Pvane  =  vane  measured  angle  of  sideslip,  and 
Plrue  =  true  angle  of  sideslip. 


(5) 


(6) 


Applying  the  appropriate  substitutions  and  algebraic  manipulations,  the  following  equations  for  true 
sideslip  and  AOA  can  be  derived: 


Sin  ( Ptrue )  , ,  \  ^an^Pvane^\^trueU°s  ( Ptrue )  U°s  {atrue  )  ^  r^y  1 

vtrue  L  J 


(7) 


Sin  (0Cfrue ) 


VtrlleCos(  ptrue) 


Tan(ccvane  )^V(rueC°s  {Ptrue  )Cos  (oCfrue  )  +  qlz  r^y\ 


+ 


The  equations  are  coupled  between  sideslip  and  AOA  and  also  contain  the  true  values  of  sideslip  and  AOA 
on  both  sides  of  the  equation.  Therefore,  the  equations  must  be  solved  iteratively  using  the  measured  vane 
values  as  starting  points.  Convergence  is  usually  quite  rapid.  However,  the  corrections  as  formulated  in 
equation  7  are  only  good  for  AOA  and  sideslips  between  +45  degrees.  Beyond  these  angles,  the  above 
formulation  will  diverge  during  the  iteration. 


There  are  some  circumstances  where  the  ±45-degree  limitation  can  be  avoided.  If  the  AOA  and  sideslip 
vanes  are  located  on  a  noseboom  such  that  the  X-body  location  of  the  vanes  is  much  larger  than  the  Y  or 
Z-body  locations,  then  it  can  be  assumed  that  the  only  critical  length  is  the  X-body  axis  location.  If  this  is 
the  case,  the  following  formulation  can  be  used; 
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This  new  formulation  does  not  suffer  from  the  +45-degree  limitation;  however,  the  new  formulation  must 
be  used  rather  than  simply  setting  the  Y-  and  Z-body  locations  to  zero  in  the  previous  formulation. 

Another  method  has  been  postulated,  which  has  the  benefit  of  requiring  no  iterations.  The  author  does  not 
have  any  direct  experience  with  this  method  and  it  is  presented  as  a  potential  alternative  to  other  methods. 
This  method’s  validity  in  actual  data  analyses  use  cannot  be  validated  by  the  author.  Figure  17  shows  the 
pertinent  angles  and  relationships  for  this  formulation. 


From  Figure  17,  it  can  be  seen  that; 

U  vane  =V 'tmeCos(8)Cos(P  vane)  =  U  cg  +  (ql  z  -  rl  y) 
Kane  =  VtrueCos(8)Sin(  pvane)  =  Vcg  +(rlx  —  pi  z) 

Wvane  =  V true' Sin(S)  =  W cg  +(Pl  y  ~  V1  x) 


By  definition; 


_  Wvane  _  Sitl(d)  _  Tail(8) 

IJvane  Cos(d)Cos(J3vane )  Cos{f5rane) 


5  -  Tan  1  [Tania vane)Cos(Pvane)] 


(9) 


(10) 


The  vane  values  and  cg  values  of  the  body  axis  velocities  are  computed  from: 

ucg  =  U  vane  —  (qlz  —  rly ) 

Vcg=Vvane-Klx- Plz)  (11) 

Wcg  _  KVane  ~  (P^y  ~  ) 


Angle  of  attack  and  sideslip  are  then  computed  from  the  definitions  of  these  angles. 
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In  all  the  pervious  formulations  there  is  an  inherent  sideslip  correction  when  the  body  axis  rates  are  zero.  In 
the  absence  of  body  axis  rates  or  upwash  and  sidewash,  the  above  reduce  to: 

Tan  (  Ptrue  )  =  Tariff}  vane  )Cos(oCfrue )  (13) 


atrue  ~  avane 

In  this  special  case,  vane  measured  sideslip  must  be  corrected  for  true  AOA.  This  results  from  the  fact  that 
most  sideslip  vanes  measure  the  sideslip  in  a  fixed  plane  (typically  the  X-Z  body  axis  plane).  This  is 
contrary  to  the  definition  of  sideslip  as  shown  in  Figure  14.  The  fixed  plane  measured  sideslip  is  often 
referred  to  as  flank  sidelip  in  much  of  the  literature,  and  is  not  the  same  as  the  definition  of  true  sideslip 
given  earlier. 

5.2.5  Inertial  Navigation  System  Corrections 

Modern  flight  test  techniques  often  use  the  INS  for  computing  various  air  data  parameters  including 
airspeed,  dynamic  pressure,  AOA  and  sideslip.  The  computations  for  these  are  outlined  in  a  later  section. 
However,  the  INS  data  also  require  some  corrections  prior  to  applying  these  techniques.  The  INS  typically 
supplies  the  North,  East  and  Down  (NED)  velocities  as  well  as  the  Euler  Angles  and  body-axis  rates.  Since 
the  Inertial  Measurement  Unit  (IMU)  is  typically  not  located  at  the  center  of  gravity,  solid  body  rotation 
will  induce  velocities  that  are  not  experienced  at  the  eg.  The  equations  for  correcting  the  INS  velocities 
back  to  the  eg  are: 


Vcg=ViNs-nxR  (14) 

where: 

VCg  =  Body  axis  velocity  vector  at  eg, 

YlNS  =  INS  measured  velocity  vector, 

Q.  =  Body  axis  rate  vector, 

R  =  Location  vector  of  INS  wrt  eg,  and 
X  =  Cross  product  operator. 

Acceleration  corrections  to  the  INS/IMU  data  may  also  be  required;  these  are  similar  to  those  for 
accelerometers  discussed  previously. 

Corrections  to  IMU/INS  measured  angles  and  accelerations  may  be  required  due  to  fuselage 
bending.  These  are  usually  difficult  to  estimate  and  generally  apply  only  to  steady-state  conditions  such 
as  constant  load  factor  maneuvers.  For  most  flying  qualities  applications,  corrections  due  to  fuselage 
bending  are  ignored. 

5.3  Other  Analysis 

5.3.1  General 

Many  other  types  of  analyses  are  typically  performed  on  the  DFCS  flight  test  data.  This  section  will  briefly 
cover  some  of  the  typical  analyses  and  data  preparation  required  to  perform  the  analyses. 

5.3.2  Aliasing 

Aliasing  during  the  digitization  of  an  analog  signal  was  covered  in  Section  3  during  the  discussion  on 
instrumentation.  However,  aliasing  can  occur  whenever  any  signal,  whether  digital  or  analog,  is  sampled  at 
a  rate  insufficient  to  define  the  highest  frequency  in  the  signal.  Aliasing  can  also  occur  when  re-sampling  a 
digital  signal  at  a  lower  rate  than  the  original  signal  was  sampled.  This  is  typical  for  many  analysis 
applications;  the  sample  rate  of  the  basic  data  may  be  much  higher  than  that  needed  for  the  analysis  and  the 
data  are  often  re-sampled  at  a  lower  rate.  This  can  lead  to  aliasing  in  the  lower  rate  data.  To  properly 


54 


re-sample,  the  data  must  be  re-filtered  with  a  digital  filter  at  the  full  rate  and  then  re-sampled  at  the  lower 
rate. 

Figures  18a  and  b  illustrates  what  can  occur  when  a  signal  is  sampled  at  a  rate  below  that  prescribed  by 
Nyquist  theory.  Figure  18c  shows  the  same  signal  sampled  at  the  Nyquist  frequency.  Figure  19  illustrates 
how  aliasing  of  noisy  data  can  induce  low  frequency  oscillations  in  the  sampled  data  that  do  not  exist  in  the 
analog  signal. 


Figure  18  Nyquist  Sampling  Theory 


Figure  19  Aliasing  of  High  Frequency  Data  to  a  Lower  Frequency 

5.3.3  Parameter  Differentiation  and  Integration 

Differentiation  and  integration  of  measured  flight  test  signals  plays  an  important  part  in  the  flying  qualities 
and  digital  FCS  analyses.  Differentiation  is  critical  in  obtaining  parameters  for  correction  of  accelerometers 
as  well  as  determining  the  aerodynamic  moments  being  applied  to  the  aircraft.  Integration  is  important  in 
simulation,  trajectory  reconstruction  and  in  validating  any  differentiation  algorithm.  Reference  6  ( Digital 
Filters)  gives  a  good  overview  and  technical  discussion  on  signal  differentiation  and  other  filtering  aspects. 
Reference  7  (Aircraft  Control  and  Simulation)  gives  a  good  discussion  on  digital  integration  routines  used 
for  simulation.  This  section  will  review  some  key  characteristics  and  describe  some  typical  methods  used 
for  differentiation  and  integration. 
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The  simplest  digital  differentiation  scheme  is  a  direct  difference  equation,  where  the  difference  between  the 
dependent  variable  at  each  sample  time  is  divided  by  the  difference  in  the  independent  variable: 


dy  _  y(n  +  l)-y(n) 
dx  x(«  +  l)-x(«) 


(15) 


where: 

x  =  independent  parameter  and 
y  =  dependent  parameter. 

By  definition,  this  is  the  estimated  derivative  at  the  one-half  sample  period  between  points.  Applying  the 
derivative  at  one  of  the  sampled  points  will  introduce  a  one-half  sample  time  shift.  This  can  be  accounted 
for  by  performing  the  computation  and  then  interpolating  the  derivative  back  to  the  sample  times,  or  by 
averaging  with  the  previous  computation  to  obtain  the  derivative  at  the  point  of  interest.  The  difference  in 
Equation  15  is  the  most  direct  computation,  but  also  has  the  disadvantage  of  supplying  the  most  noise 
amplification.  The  noise  can  be  attenuated  by  applying  any  of  several  filtering  algorithms  explained  later  in 
this  section.  Reference  6  also  includes  schemes  for  applying  the  differentiation  and  filtering  process  in  a 
single  step. 

Another  method  used  for  differentiation  is  to  fit  a  second  (or  higher)  order  polynomial  though  N  data  points 
distributed  before  and  after  the  time  point  in  question.  The  derivative  at  the  time  point  in  question  is  then 
readily  computed  by  applying  the  analytical  derivative  of  the  polynomial  at  that  point.  The  number  of 
points  used  will  also  act  as  a  smoothing  device,  the  smoothing  effect  increasing  with  the  number  of  points. 
Equation  16  shows  an  example  for  a  second  order  polynomial: 

y(t)  =  ax(t)2  +  bx(t)  +  c  (16) 

In  Equation  17,  a,  b  and  c  are  solved  via  a  least-squares  fit  of  the  data  points  passing  through  the  I'th  data 
point  of  interest.  Once  the  coefficients  have  been  estimated,  then  the  derivative  at  the  I'th  point  is  computed 
by: 


dy- 

— 1  =  2ax-  +  b 
dt  1 


(17) 


Integration  is  also  used  extensively  in  follow-on  data  processing  involving  simulation  or  trajectory 
reconstruction.  Reference  7  covers  several  excellent  digital  integration  schemes  for  data  processing  or 
simulation  use.  Integration  of  a  digital  signal  also  suffers  from  the  discrete  nature  of  the  data.  Inaccuracies 
in  the  integration  process  arise  from  assuming  the  integrated  signal  is  held  constant  over  the  time  interval  of 
interest,  adding  error.  The  error  typically  will  be  reduced  as  the  sampling  time  decreases.  The  author  has 
had  excellent  luck  in  using  either  third  or  fourth  order  Runnga-Kutta  fixed  interval  routine,  which  is  a  good 
compromise  between  computational  speed  and  integration  error. 

5.3.4  Mass  Properties 

The  mass  properties  of  an  aircraft  include  the  total  gross  weight,  three  axis  eg  locations,  and  the  moments 
and  products  of  inertia.  Gross  weight,  eg  location  and  inertias  are  constantly  changing  on  an  aircraft  due  to 
stores  carriage  or  separation  as  well  as  fuel  burn.  The  degree  of  these  changes  over  a  test  mission  will 
depend  on  the  aircraft  and  particular  mission. 

Mass  property  computation  is  extremely  important  for  flying  qualities  and  DFCS  data  analyses.  The 
dynamics  of  the  aircraft  can  vary  significantly  with  changes  in  weight,  eg  and  inertia.  Unfortunately, 
accurate  mass  property  information  can  be  difficult  to  obtain  for  a  dynamic  maneuvering  aircraft.  The  main 
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problem  is  accurately  measuring  fuel  quantity  and  location  dining  maneuvering  flight.  Even  with  baffled 
tanks,  fuel  is  constantly  moving  during  dynamic  maneuvers  and  determining  the  local  eg  of  the  fuel  is 
almost  impossible.  In  addition,  fuel  slosh  can  invalidate  the  quantity  measurements  of  the  fuel  probes. 
Accurate  mass  properties  computations  require  both  accurate  quantity  and  location  information,  neither  of 
which  exist  during  many  flight  test  maneuvers.  A  solution  to  this  problem  is  to  compute  the  mass  properties 
during  benign  trim  maneuvers,  prior  to  a  maneuver  entry,  and  then  hold  the  values  constant  during  the 
maneuver.  Most  flying  qualities-type  maneuvers  are  of  short  enough  duration  that  the  fuel  burn  is 
inconsequential  during  the  maneuver.  Another  solution  is  to  compute  the  mass  properties  at  a  benign  trim 
point  before  and  after  the  maneuver  and  linearly  interpolate  with  time.  However,  neither  solution  will 
provide  accurate  mass  properties  computations  during  the  dynamic  portion  of  the  maneuver.  Fortunately, 
the  approximations  mentioned  should  provide  sufficient  quality  data  for  further  analyses. 

The  static  3  axis  centers  of  gravity  about  a  fixed  datum  can  be  computed  using  the  following  equations: 


where: 
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VctO+ZV'Sl 

cgd~  W,0  *}W,i 

Ycsd ~  w,o  +  pn- 

VctO  +  ZVcg, 
Zcgi~  W,0  +}WH 
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Xcg, 

Ycgl 

Zcgi 


basic  zero  fuel  weight, 

Xcg  from  measurement  datum, 

Ycg  from  measurement  datum, 

Zcg  from  measurement  datum, 
basic  zero  fuel  Xcg  from  measurement  datum, 
basic  zero  fuel  Ycg  from  measurement  datum, 
basic  zero  fuel  Zcg  from  measurement  datum, 
individual  fuel  or  stores  weight, 

individual  fuel  or  stores  Xcg  from  measurement  datum, 
individual  fuel  or  stores  Ycg  from  measurement  datum,  and 
individual  fuel  or  stores  Zcg  from  measurement  datum. 


The  moments  and  products  of  inertias  about  a  fixed  datum  can  be  calculated  as  follows: 


(18) 


f xx  d  IxxO  +  ^mi^hi  +  ^zi  1 +  ? 1  xxi 
!yy  d=IyyO  +  Z  mi  (lxC  +  lzC ]  +  S  lyyi 
1 zz  d  =  1 zzO  +  ?  mi  (-hi  +  ^xi  1 +  %  lzzi 
Iabd=IabO  +  yni(lai  !bi  ^Z^bi 


(19) 
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where: 


IxxdTyydTzzd 

labd 

Tbi 

IxxJyyJzziXihi 

hxoJyyoJzzoJabO 

m, 

Xi,yi,zi 
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moments  of  inertia  about  measurement  datum, 
cross  products  of  inertia  about  measurement  datum, 
cross  products  of  inertia  about  own  eg, 
i’th  component  inertias  about  own  eg, 
baseline  aircraft  inertias  about  aircraft  zero  fuel  eg, 
individual  fuel  or  stores  mass, 

distance  of  individual  fuel/store  from  measurement  datum,  and 
index  of  individual  fuel  or  store. 


The  inertias  must  now  be  transferred  from  the  fixed  datum  to  the  aircraft  eg; 
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(20) 


where: 

Ixx  ,  lyy  cg,  IZz  cg>  lab  eg  =  aircraft  inertias  about  aircraft  eg, 
aCgd.  bcg(j  =  appropriate  component  cg  locations, 

Wt  =  total  aircraft  weight,  and 

g  =  acceleration  due  to  gravity. 

Problems  can  be  encountered  when  accounting  for  fuel  inertias  about  its  own  cg.  Since  liquid  fuel  does  not 
act  exactly  as  a  rigid  body,  simply  computing  the  mass  moment  of  inertia  about  the  fuels  cg  may  cause 
error.  Assuming  the  fuel  to  be  a  rigid  body  is  an  assumption  whose  validity  depends  on  factors  such  as,  the 
amount  of  fuel  in  the  tank,  the  shape  of  the  tank,  the  amount  of  baffling  in  the  tank,  and  the  location  of  the 
tank  with  respect  to  the  center  of  rotation.  This  is  a  problem  which  has  no  direct  or  simple  solution,  only 
varying  degrees  of  approximation.  One  solution  is  to  assume  the  fuel  acts  as  a  rigid  body  and  use  its  static 
inertia  about  its  own  cg.  If  the  fuel  tank  is  located  a  significant  distance  from  the  aircraft  cg  such  that  the 
mass  contribution  to  the  aircraft’s  inertia  is  much  larger  than  the  fuels  own  inertia  contribution,  than  it  may 
be  possible  to  ignore  the  fuels  inertia  about  its  own  cg.  Another  method  is  to  combine  the  two  methods,  and 
assume  that  the  fuel  will  act  somewhere  between  having  rigid  body  inertia  and  no  inertia  about  its  own  cg. 

5.3.5  Parameter  Filtering 

Reference  6  contains  algorithms  for  filtering  and  smoothing  digital  signals.  The  subject  can  be  complicated, 
and  care  should  be  taken  to  properly  apply  any  filtering  technique.  Filtering  inherently  adds  phase  lag  to 
any  signal  processed  through  the  filter.  However,  if  the  full-time  history  of  a  digitized  signal  is  available, 
the  phase  lag  can  be  accounted  for.  Simply  reversing  the  time  sequence  of  the  signal  and  reprocessing  back 
through  the  filter  and  then  reversing  the  time  sequence  back  to  the  original  will  remove  the  phase  shifts 
imparted  by  the  filter.  This  will  also  provide  a  doubling  of  the  gain  attenuation  characteristics  of  the  filter. 
This  method  will  only  work  if  the  entire  time  sequence  of  the  signal  is  available,  it  will  not  work  for  a  real¬ 
time  application.  Real-time  filters  will  inherently  add  phase  lag  to  the  signal. 

Phase  lags  imparted  by  filtering  can  be  critical  when  trying  to  apply  some  postflight  processing  techniques 
such  as  parameter  identification,  trajectory  reconstruction,  or  comparison  to  simulations.  For  these 
applications,  the  relative  phase  lag  between  signals  can  be  critical.  The  relative  phase  lags  can  be 
eliminated  by  either  applying  the  above  forwards/backwards  scheme  to  recorded  data,  or  by  applying  the 
same  filter  to  all  signals  to  be  analyzed.  The  latter  will  work  in  a  real-time  environment. 
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A  multiple  pole  Butterworth  filter  and  a  forwards/backwards  filtering  algorithm  is  often  used  to  postflight 
filter  flight  test  data.  Filter  parameters  are  determined  by  the  sampling  rate  and  power  spectral  density 
(PSD)  characteristics  of  the  unfiltered  signal.  Sufficient  data  from  a  variety  of  maneuvers  are  analyzed  to 
determine  the  best  compromise  for  the  filter  parameters.  When  differentiation  is  involved,  the  parameters 
are  further  checked  by  reintegrating  the  differentiated  signal  and  comparing  with  the  original. 

5.3.6  INS  Air  Data  Computations 

Air  data  can  be  computed  from  the  three  axis  IMU  velocities  such  as  those  from  a  modern  INS.  However, 
an  IMU/INS  only  generates  velocities  relative  to  the  earth,  and  does  not  account  for  the  winds.  Air  data  are 
measured  relative  to  the  local  air  mass  and  do  include  the  winds.  The  IMU/INS  measured  velocities  must 
be  corrected  for  winds  in  order  for  them  to  be  used  for  air  data  computations.  The  primary  challenge  with 
using  the  INS/IMU  velocities  becomes  one  of  computing  the  local  winds.  Atmospheric  balloon  measured 
winds  are  usually  not  acceptable  since  they  are  inaccurate  (to  the  degree  required)  and  the  winds  can  vary 
significantly  from  the  time  of  the  balloon  measurement  to  the  time  of  the  test.  The  computation  of  the 
winds  can  be  achieved  in  many  ways,  depending  on  the  desired  application.  All  methods  require  separate 
and  accurate  measurements  of  airspeed,  pitch  attitude,  bank  angle  and  heading  angle.  In  most  methods, 
assumptions  must  also  be  made  which  can  impact  the  accuracy  of  the  results.  The  following  will  describe 
several  methods  for  obtaining  the  winds. 

Equations  21  through  24  describes  the  general  method  for  computing  the  winds.  True  airspeed  (V,luc)  is 
measured  from  a  separate  source  such  as  the  calibrated  Pitot-static  system.  The  winds  are  required  in  the 
NED  axis  system  as  opposed  to  the  wind-axis  system  where  the  true  airspeed  is  measured. 

The  transformation  matrices  from  the  wind-axis  system  to  NED  system  are: 


cosy/ 

sint/r  0 

cos  0 

0 

-sin# 

‘1 

0 

0 

M= 

-  sint/r 

cost/r  0 

[*]  = 

0 

1 

0 

M  = 

0 

cos  0 

sin0 

0 

0  1 

sin# 

0 

cos  # 

0 

-  sin  0 

cos  0 

cos  a 

0 

-sin  a 

cos  (3 

— 

sin  p  0 

[«]= 

0 

1 

0 

m= 

sin  /3 

cos  /3  0 

sin  a 

0 

cos  a 

0 

1  0 

The  winds  in  the  NED  system  are  then  computed  by: 


^ True  North 

^ true 

^ True  East 

=w\  [0]  m  [«]  m 

0 

^ True  Down 

0 

^ WindNorth 

rue  North 

^ INSNorth 

^ WindEast 

= 

^ TrueEast 

- 

VINSEast 

yWindDown  _ 

yTrueDown  _ 

y INSDown  _ 

(21) 


(22) 
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(24) 


The  first  and  simplest  method  for  computing  the  winds  is  from  constant  altitude,  wings-level  flight  and  an 
assumption  of  zero  sideslip.  For  constant  altitude,  zero  sideslip  and  wings-level  flight,  AOA  can  be 
assumed  to  be  equal  to  pitch  attitude. 

0,  B  and  —or  y  =  0  ,0. , 

dt  (25) 


a  =  0 


(26) 
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where: 

0  =  bank  angle, 

6  =  pitch  attitude, 

a  =  angle  of  attack, 

ft  =  sideslip, 

y  =  flightpath,  and 

dh  f  , 

—  =  rate  of  climb, 
dt 


The  winds  are  computed  by  using  the  previously  mentioned  algorithm  and  assuming  that  AOA  is  equal  to 
pitch  attitude  and  that  sideslip  is  zero.  Winds  are  held  constant  throughout  the  maneuver. 

The  second  way  to  compute  the  winds  involves  solving  a  least-squares,  nonlinear  minimization  problem. 
The  vertical  component  of  the  wind  is  assumed  to  be  zero  and  a  scalar  cost  function  is  defined  as: 
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where: 

V  INS  North  i 

=  i’th  data  point  North  INS  velocity, 

V  INS  East  i 

=  i’th  data  point  East  INS  velocity. 

Wnic  i 

=  i’th  true  airspeed  data  point,  and 

J 

=  scalar  cost  function. 

Any  nonlinear,  iterative,  minimization  procedure  is  then  used  to  minimize  the  cost  function  to  estimate  the 
constant  values  for  East  and  North  winds.  In  theory,  the  vertical  wind  component  can  also  be  identified; 
however,  the  AFFTC  has  had  little  luck  in  trying  to  derive  reasonable  values  for  this  parameter  using  the 
above  method. 

A  third  way  to  compute  the  winds  assumes  a  separate  measurement  of  true  airspeed,  AOA,  and  sideslip. 
This  method  is  often  used  when  INS/IMU  derived  air  data  are  desired  at  conditions  where  classic 
calibrations  of  the  measured  vane  and  Pitot-static  system  values  are  not  valid.  The  winds  are  computed 
while  at  flight  conditions  where  the  classical  calibrations  are  valid  and  then  held  constant  while 
maneuvering  outside  of  these  regions.  A  typical  use  might  be  during  high  AOA  or  departure  testing  where 
large  values  of  AOA  and  sideslip  can  be  expected.  For  High  AOA,  large  variations  in  altitude  can  also  be 
encountered;  therefore,  the  winds  are  often  computed  and  stored  as  a  function  of  altitude  during  a  wind- 
calibration  climb  up  to  the  maneuver  entry  altitude.  Winds  are  computed  and  tabulated  as  a  function  of 
altitude  and  then  added  appropriately  to  the  INS/IMU  velocities  during  the  maneuver. 

Once  the  winds  are  available  in  the  NED  system,  the  following  can  be  used  to  compute  the  true  airspeed, 
AOA  and  sideslip: 
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where: 


Ubody  wind?  Vbody  wind?  ^^body  wind 

=  X,  Y,  Z  body  axis  wind  components. 

V  true  INS 

=  true  airspeed  computed  from  INS  velocities  and  winds. 

GWe 

=  true  AOA, 

Arue 

=  true  sideslip,  and 

V xbody  INS?  Vybody  INS?  Vzbody  INS 

=  INS  body  axis  velocities. 

5.3.7  Force  and  Moment  Computations 
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Total  applied  forces  and  moments  can  be  computed  from  the  flight  test  data.  Total  applied  forces  (gravity  is 
not  an  applied  force)  can  be  modeled  with  Newton’s  second  law; 
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where: 


F 

A  aero 

=  vector  of  aerodynamic  forces. 

F  thrust 

=  vector  of  thrust  forces. 

N 

1,1  xcg 

=  X  body  axis  load  factor. 

N 

l>ycg 

=  y  body  axis  load  factor,  and 

N 

-^zcg 

=  -z  body  axis  load  factor. 

The  total  applied  force  is  computed  from  the  flight  measured  (and  corrected)  load  factors.  In  order  to 
separate  out  the  aerodynamic  and  thrust  components,  a  thrust  model  and  a  gravity  model  are  required.  For 
most  applications,  assuming  a  simple  scalar  value  for  gravity  (approximately  32.174  ft/s2)  is  appropriate. 
For  conditions  where  more  accuracy  is  required,  or  the  flat  nonrotating  earth  equations  of  motion  do  not 
apply,  a  more  complex  gravity  model  may  be  required  (Evolution  of  Flight  Vehicle  System  Identification, 
Reference  8).  The  engine  or  thrust  forces  are  usually  computed  from  an  engine  model;  the  complexity 
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required  depending  on  the  desired  accuracy.  A  detailed  propeller  model  may  also  be  required  for  propeller- 
driven  aircraft.  The  components  from  these  models  are  then  computed  and  subtracted  from  the  measure 
applied  forces  to  obtain  the  aerodynamic  contributions. 
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where: 

— > 

F 

1  aero 

=  vector  of  aerodynamic  forces. 

— > 

F thrust 

=  vector  of  thrust  forces,  and 

Wt 

=  weight. 

When  engine  models  are  not  available,  the  total  forces  as  measured  by  an  accelerometer  will  include  both 
aerodynamic  and  engine  components.  Fortunately  for  most  stability  and  control  applications  and  with 
conventional  aircraft,  the  engine  forces  are  usually  aligned  parallel  to  the  X-body  axis  and  the  aircraft 
normal  and  side  forces  will  have  minimal  engine  contributions.  This  is  not  the  case  for  aircraft  with  large 
thrust  offset  or  for  thrust  vectored  aircraft.  In  these  cases,  some  form  of  thrust  model  is  required  to  separate 
aerodynamic  and  thrust  forces. 

The  moment  computations  are  developed  in  a  similar  fashion. 
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M=MappIied=  — 
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where: 

vector  of  angular  momentum, 
vector  of  moments, 
vector  of  applied  moments, 
vector  of  aerodynamic  moments, 
vector  of  thrust  moments,  and 

vector  of  propeller  moments  or  other  rotating  component  moments. 

The  aerodynamic  component  arises  from  either  the  basic  flow  about  the  aircraft  or  from  deflection  of 
control  surfaces.  The  thrust  moments  arise  from  the  alignment  of  the  thrust  vector  with  the  aircraft  eg.  The 
propeller  moments  are  direct  torques  applied  from  the  rotating  compressors,  fans  or  propellers.  These  are 
usually  small  for  a  jet  aircraft,  but  can  be  large  for  a  propeller-driven  aircraft. 

Assuming  that  the  inertias  are  constant  over  the  time  frame  of  interest,  and  that  the  two  sources  of  angular 
momentum  are  the  rotating  body  and  rotating  engine  parts,  the  angular  momentum  is: 
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where: 

H  =  angular  momentum, 

COt,  =  [p,  q,  r]T  vector  of  body  axis  angular  rates,  and 

COeng  =  [coxe,  C0ye,  C0ze]  vector  of  engine  rotation  rates  in  body  axis. 
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Applying  the  appropriate  rotating  frame  differentiation  and  assuming  constant  inertias: 
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Therefore,  from  Equation  36,  the  applied  moment  is: 

dm,,  _  dm  _  _  (41) 

applied  h  +  %  X  h®b  +  I  eng  — ~ ~  X  I eng® eng 

Equation  41  requires  the  engine  rotating  component  of  the  inertias,  and  aircraft  body  inertias  as  well  as  the 
respective  angular  rates  and  accelerations.  Often  the  engine  rotating  rates  are  considered  constant.  The 
aerodynamic  moments  can  be  computed  by  subtracting  model  values  of  the  thrust  and/or  propeller 
moments  from  the  total  applied  moments. 

M aero  ~  ^ applied  ~  ^ thrust  ~  ^ prop  (42) 

If  significant,  the  thrust  and  propeller  moments  are  usually  computed  from  propulsive  and  propeller 
models.  In  some  cases  they  can  be  directly  measured  (i.e.,  a  torque  meter  on  a  propeller  aircraft).  For 
nonthrust  vectored  jet  aircraft,  with  the  thrust  vector  aligned  approximately  through  the  eg.  Equation  42 
will  give  a  good  approximation  of  the  aerodynamic  moments. 

5.3.8  Aerodynamic  Parameter  Identification 

One  of  the  key  aspects  of  the  predict,  test,  update,  and  validate  test  method  is  the  comparison  of  predicted 
and  flight-derived  aerodynamic  models,  combined  with  the  updating  of  the  predicted  model  based  on  test 
results.  The  science  and  art  of  aerodynamic  parameter  identification  covers  volumes  of  text  and  technical 
papers.  Reference  8,  Evolution  of  Flight  Vehicle  System  Identification,  gives  an  excellent  overview  of  the 
subject.  Reference  9,  Application  of  Parameter  Estimation  to  Aircraft  Stability  and  Control,  The  Output 
Error  Approach,  gives  technical  details  on  algorithmic  implementation.  This  section  will  cover  a  brief 
review  of  the  different  types  of  parameter  identification  and  some  of  the  necessary  requirements  for 
obtaining  good  results.  Experience  has  indicated  that  obtaining  good  aerodynamic  parameter  estimates  is  as 
much  an  art  as  a  science.  While  modern  parameter  estimation  techniques  have  solid  and  well-founded 
mathematical  roots,  the  actual  application  and  use  has  been  found  to  be  as  much  a  function  of  the 
knowledge  and  experience  of  the  analyst  as  with  the  algorithm  itself. 

Modern  aerodynamic  parameter  identification  techniques  are  dependent  on  instrumentation,  test  techniques 
and  data  analyses  methodologies.  Each  is  critical  and  must  be  properly  addressed  in  order  to  obtain 
acceptable  results.  Improper  consideration  in  any  of  these  areas  can  lead  to  poor  parameter  identification 
results. 

The  instrumentation  system  must  be  high  fidelity  with  proper  resolution,  sample  rates,  filtering,  and  few  or 
no  unknown  time  delays  between  parameters.  Poorly  designed  instrumentation  systems  will  result  in  poor 
aerodynamic  parameter  estimates.  Any  aircraft  state,  control,  or  output  parameter  which  is  misrepresented 
by  the  instrumentation  system  will  have  cascading  impacts  on  estimated  aerodynamic  derivatives. 
Resolution  must  be  sufficient  to  catch  the  smallest  increment  in  a  state,  control,  or  output,  which  is 
significant  to  the  dynamics  of  interest.  The  resolution  should  also  be  finer  than  the  expected  noise 
characteristics.  Likewise,  range  must  be  sufficient  to  catch  the  largest  variation  desired.  Calibration  must  be 
of  acceptable  quality  to  ensure  that  the  actual  measured  state,  control,  or  output  variable  is  as  indicated. 
Sample  rate  is  also  key  in  aerodynamic  parameter  estimation.  Reference  10,  Effects  of  Flight 
Instrumentation  Errors  oil  the  Estimation  of  Aircraft  Stability  and  Control  Derivatives,  gives  an  excellent 
overview  of  the  basic  instrumentation  requirements  for  aerodynamic  parameter  identification.  One  of  the 
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most  potentially  devastating  impacts  of  an  instrumentation  system  on  parameter  identification  results  is 
relative  time  delays  and/or  phase  shifts  between  signals.  There  are  several  sources  of  potential  time  delays 
and  phase  shifts  in  sampled  data  systems.  Pure  time  delays  can  arise  when  parameters  are  sampled  serially 
within  the  allotted  sample  timeframe.  They  can  also  arise  from  communication  across  data  buses  or  through 
multiple  computers.  Phase  lag  can  be  imparted  by  anti-aliasing  filtering  or  any  other  type  of  analog  or 
digital  filtering.  Phase  lags  produce  an  apparent  time  delay,  which  is  a  function  of  frequency  of  the  signal, 
increasing  the  time  delay  with  higher  frequencies.  Reference  11,  Effects  of  Time-Shifted  Data  on  Flight 
Determined  Stability  and  Control  Derivatives,  gives  an  excellent  accounting  of  the  impacts  of  time  delays 
on  aerodynamic  parameter  identification  results. 

Flight  test  maneuvers  must  be  designed  to  provide  the  appropriate  response  and  frequency  content  for  the 
maneuvers  of  interest.  Maneuver  duration  and  input  sequencing  must  be  considered.  In  addition,  identifiability 
of  the  desired  parameters  must  be  ensured.  As  an  example,  a  roll  command  input  where  both  the  ailerons  and 
rolling-tail  move  in  a  linear  dependent  fashion  will  not  produce  sufficient  information  to  identify  both  the 
aileron  and  rolling  tail  parameters.  In  this  case,  separate  surface  inputs  (i.e.,  the  PTI  explained  in  Section  3) 
are  required  to  provide  sufficient  information  to  derive  the  control  powers  for  both  the  aileron  and  the  rolling 
tail.  The  same  will  exist  for  any  linearly  connected  parameter.  The  AFFTC  has  traditionally  used  the  doublet 
maneuver  derive  flight  test  parameter  estimates.  The  3-2-1-1  maneuver  is  favored  in  Europe  for  parameter 
identification.  The  AFFTC  method  has  traditionally  used  a  1-  to  3-second  duration  symmetrical  doublet.  More 
recently,  this  has  been  modified  to  be  a  rapid  (less  than  1  second)  input  followed  by  the  traditional  doublet. 
The  rapid  movement  was  added  in  order  to  increase  the  high  frequency  content  of  the  input.  The  3-2-1-1 
maneuver  is  a  3-second-square  input  in  one  direction,  followed  by  a  2-second-square  reversal,  followed  by  a 
2-second-symmetrical  doublet.  In  addition  to  these  types  of  maneuvers,  the  frequency  sweep  has  also  been 
used  for  parameter  identification.  The  frequency  sweep  is  generally  used  when  parameter  identification  is 
being  accomplished  within  the  frequency  domain;  however,  these  maneuvers  can  also  be  used  for  time 
domain  parameter  identification. 

There  are  three  basic  parameter  estimation  or  identification  techniques  in  use  today.  These  are  the  equation 
error,  output  error,  and  filter  error  techniques.  Reference  8  gives  a  good  overview  of  these  techniques. 

The  equation  error  technique  typically  matches  the  state  or  outputs  rates  in  some  fashion.  This  method  sets 
up  a  form  of  a  linear  model  of  the  dependent  parameter  as  a  function  of  the  independent  variable,  and  then 
produces  estimates  of  the  parameters  with  a  least  squares  match; 


Z  =  HO 


(43) 


where: 


9  =  [0j,  ft . 0M]  ,  vector  of  unknown  constants, 

H  =  [hl5  h2,  ...hn],  vector  of  measures  states,  outputs,  or  inputs,  and 
Z  =  [Zu  Z2,  ...  -Zn]T,  vector  of  responses. 

The  least  squares  solution  to  find  the  constant  parameters  is: 

9  =  {hthY  HtZ  (44) 

This  method  is  simple,  and  requires  neither  integration  nor  iterations.  The  above  solution  in  Equation  44  can 
be  processed  in  either  a  batch  or  recursive  fashion.  The  computations  can  be  carried  out  quickly  with  modern 
computers.  More  advanced  variations  of  this  technique  have  also  been  used.  The  mathematical  literature  often 
berates  the  technique  for  being  asymptotically  biased  as  opposed  to  unbiased  techniques  using  the  other  two 
methodologies.  However,  it  has  been  successfully  used  in  multiple  instances.  This  method  does  require  higher 
quality  data  and  is  more  sensitive  to  the  relative  phasing  of  the  measurements  than  do  the  other  methods.  In 
addition,  the  method  is  also  more  sensitive  to  noise  than  other  techniques.  For  this  reason,  the  data  are  often 
preprocessed  through  a  trajectory  reconstruction  algorithm  to  estimate  the  states  and  outputs  to  ensure 
kinematic  consistency  of  the  measurements.  This  additional  step  can  often  reduce  the  benefits  of  the  technique 
by  complicating  the  analyses. 
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The  output  error  method  is  perhaps  the  most  common  method  in  use  today.  This  method  is  a  nonlinear 
method  that  uses  the  aircraft  equations  of  motion  as  well  as  statistical  estimation  of  the  measurement  noise 
to  estimate  the  aerodynamic  parameters.  Perhaps  one  of  the  best  known  of  the  algorithms  is  the  Modified 
Maximum  Likelihood  Estimator  (MMLE)  (Reference  9)  and  its  descendent  Pest  developed  by  the  NASA 
Dryden  Flight  Research  Center  (DFRC).  The  aircraft  dynamics  are  defined  by  a  set  of  state  rate,  output  and 
measurement  equations  (linear  or  nonlinear); 

—  =  f(x,u,t ) 
at 

y  =  g(x,u,t)  (45) 

z  —  g(x,u,t)  +  v 

where: 

x  =  aircraft  state  vector, 
u  =  aircraft  input  vector, 
y  =  aircraft  output  vector, 
z  =  aircraft  measurement  vector, 
v  =  measurement  noise  vector,  and 
t  =  time. 


Given  a  set  of  constant  parameters  which  define  the  system  model: 

o  =  [e i  e2  .  e„] 

A  scalar  cost  function  is  defined  which  requires  minimization: 


X-[* 


i  measured 


i= 1 


-z, 


•rn 


7  —7 

measured  i  estimate 


where: 

J  =  scalar  cost  function, 

Zimeasured  =  vector  of  i'th  measurement, 

— > 

Zimeasured  -  vector  of  i’th  estimated  measurement, 
R  =  measurement  covariance  matrix,  and 

I  =  index  of  measurements. 
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The  estimated  values  in  Equation  47  are  computed  by  the  model  with  the  latest  parameter  updates  and  the 
measured  parameters  are  the  instrumented  states  and  outputs.  The  matrix  R  is  the  noise  covariance  matrix 
for  the  instrumented  parameters.  A  solution  for  a  new  update  vector  is: 

e*w=4«+4  (48) 
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where: 


8g  =  vector  of  updates  to  parameters, 


3J 

dO 

d2J 


=  gradient  of  cost  function  wrt  the  parameters. 


=  approximated  second  gradient  of  cost  function  wrt  the  parameter,  and 


dZ, 


i  measured 


do 


=  gradient  of  the  measurements  wrt  the  parameters. 


The  gradient  of  the  measurements  with  respect  to  the  parameters  is  normally  computed  numerically  for 
nonlinear  applications.  In  some  instances,  the  gradient  can  be  computed  analytically.  The  MMLE  method  is 
the  most  used  and  has  been  in  practice  at  the  AFFTC  and  DFRC  since  the  mid  1970’s  and  has  proven  to  be 
extremely  powerful. 

The  third  method,  filter  error,  accounts  for  both  the  process  as  well  as  measurement  noise.  This  method 
most  commonly  applies  a  Kalman  filtering  technique  to  estimate  the  aircraft  states,  outputs  and 
measurements  based  on  measured  inputs,  and  then  updates  the  estimated  states  and  outputs  based  on  a 
proportional  difference  between  the  estimated  and  measured  parameters.  The  constant  of  proportionality  is 
the  Kalman  gain  matrix.  The  aircraft  dynamics  are  modeled  similar  to  those  of  the  output  error  method, 
with  the  exception  that  process  noise  is  present. 

=  f(x,u,t)  +  f(t ) 
at 

/-  -  (52) 

y  =  g(x,u,t) 

z  -  g(x,ii,t)+v(t) 


where: 

x  =  aircraft  state  vector, 
u  =  aircraft  input  vector, 
y  =  aircraft  output  vector, 
z  =  aircraft  measurement  vector, 
v  =  measurement  noise  vector,  and 
t  =  time. 


The  state  vector  now  contains  the  unknown  parameters  as  well  as  the  aircraft  states.  The  state  vector  is  also 
augmented  with  process  noise. 

The  general  update  equation  is; 


new  T estimated  ^  \_^ measured  ^ estimated  ] 


(53) 


where: 


^new 

=  updated  estimated  state  vector. 

X  estimated 

=  last  estimated  state  vector. 

Z  measurement 

=  actual  measurement  vector. 

^estimated 

=  estimated  measurement  vector,  and 

K 

=  Kalman  Gain  matrix. 

The  estimated  values  of  the  states  and  measurements  are  extrapolated  from  the  current  time  point  to  the 
next  time  point  by  integrating  the  state-rate  equations.  The  states  are  then  updated  using  the  Kalman  Gain 
matrix  and  the  difference  between  the  actual  and  the  estimated  measurements.  The  computation  of  the 


66 


Kalman  Gain  matrix  involves  the  co-variances  of  both  the  process  and  measurement  noise  and  the 
covariance  of  the  overall  error.  The  covariance  of  the  overall  error  changes  with  time  and  hence  is 
extrapolated  and  updated  from  the  current  to  the  next  time  point  much  as  are  the  states.  The  details  of  this 
operation  and  the  updating  of  the  Kalman  Gain  matrix  are  beyond  the  scope  of  this  document.  Reference 
12,  Applied  Optimal  Estimation,  gives  details  on  the  computation  of  Kalman  Gain  matrix  and  the 
covariance  propagation  for  both  linear  and  nonlinear  systems.  This  method  is  not  widely  used  in  direct 
aircraft  aerodynamic  parameter  estimation  due  to  the  sensitivity  of  the  answers  to  process  and  measurement 
noise.  Obtaining  accurate  values  for  both  the  process  and  measurement  noise  covariance  is  difficult  in  most 
practical  flight  test  applications.  However,  if  reasonable  values  for  both  the  process  and  measurement  noise 
can  be  determined,  this  method  can  produce  excellent  results. 

Both  the  output  and  filter  error  methods  are  designed  to  accommodate  noise.  The  output  error  method 
specifically  assumes  that  there  is  no  process  noise  (i.e.,  there  is  no  uncorrelated  noise  in  the  aircraft  states 
such  as  turbulence).  The  method  assumes  that  all  the  noise  exists  in  the  measurements  and  that  it  is  white 
noise  with  zero  mean,  and  a  known  covariance  with  a  Gaussian  distribution.  The  filter  error  method  is 
designed  to  include  the  process  noise,  but  makes  similar  assumptions  that  the  noise  is  white  zero  mean  and 
Gaussian.  Measurement  noise  can  be  assumed  to  be  added  by  the  instrumentation  system,  and  for  a  well 
designed  system  the  assumption  of  white  noise  contamination  is  reasonable.  However,  almost  no  noise  in 
aircraft  data  are  purely  white,  and  the  degree  that  the  assumption  is  violated  will  degrade  the  analytical 
results.  As  an  example,  turbulence  is  not  white  noise,  it  also  has  no  correlated  input,  but  does  show  up  in 
the  measured  aircraft  response.  Another  example  of  nonwhite  noise  is  aircraft  buffet  and  structural  modes. 
Both  of  these  can  be  picked  up  by  the  instrumentation  system  and  each  are  likely  to  have  a  well  defined 
frequency  band  through  which  they  operate.  Noise,  either  process  or  measurement,  will  inherently  degrade 
parameter  estimates. 

5.3.9  Frequency  Response  Analyses 

Frequency  response  analyses  is  another  form  of  parameter,  or  more  accurately,  systems  identification. 
Rather  than  identify  specific  parameters,  the  method  is  used  to  identify  system  characteristics  such  as 
transfer  functions.  However,  the  method  can  be  expanded  to  include  individual  parameter  identification  and 
has  been  widely  used  for  this  purpose  in  rotary  wing  aircraft.  In  this  document,  we  will  confine  the 
discussion  to  the  more  classical  use  in  system  as  opposed  to  parameter  identification. 

The  method  applies  the  discrete  FFT  to  the  flight  data  to  transform  from  the  time  to  the  frequency  domain. 
Frequency  response  methods  assume  linearity,  and  are  limited  to  estimating  systems  where  linear 
approximations  are  valid.  The  FFT  is  based  on  the  classical  Fourier  Transform,  where  a  time  domain  signal 
is  transformed  into  the  frequency  domain  with  the  following; 


(54) 


where; 

k  =  index  of  frequencies, 

N  =  number  of  points, 
n  =  index  of  time  points, 

T  =  time  length  of  time  history, 

j=  V  -l, 

E  =  exponential  operator,  and 

®k=  _2tl  . 

T 
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From  this  discrete  transformation,  the  magnitude  and  phase  relationships  for  a  given  signal  can  be 
generated  from; 


The  method  is 
relationships; 


MaSk  =  yjak2  +h 


(55) 


ft  -1 
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(56) 


limited  in  the  range  of  frequencies  which  can  be  discretely  analyzed  by  the  following 


High‘s‘ 


(57) 
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where: 

AT  =  sample  rate  and 
T  =  total  time. 

Higher  frequency  bands  of  interest  require  higher  sample  rates  as  determined  by  the  Nyquist  frequency.  In 
addition,  if  significant  lower  frequency  content  is  desired  then  the  maneuver  must  be  of  sufficient  length. 
Both  are  considerations  in  using  the  FFT  for  aircraft  systems  identification.  Maneuver  length  can  be 
adjusted  to  provide  the  low  frequency  content;  however,  the  high  frequency  content  will  be  limited  by  the 
instrumentation  system.  If  high  frequency  content  is  desired  for  postflight  data  analyses,  then  the  sample 
rate  of  the  instrumentation  system  should  be  set  accordingly. 

As  previously  mentioned,  the  method  assumes  linearity.  The  degree  of  nonlinearity  in  the  system  under 
analyses  will  determine  the  robustness  of  the  analyses.  Nonlinearities  such  as  non-proportional  response, 
dead  bands,  hysterisis,  and  saturation  will  degrade  the  analyses,  and  if  severe  enough,  can  invalidate  the 
analyses.  Care  must  be  exercised  to  ensure  that  the  test  maneuvers  and  conditions  will  maintain  sufficient 
linearity  in  order  to  achieve  valid  frequency  response  data. 

Linear  systems  can  often  be  described  using  transfer  functions.  A  transfer  function  is  a  linear  operator 
which  describes  the  magnitude  and  phase  relationship  ratio  between  the  input  and  output.  When  multiplied 
by  a  given  input,  the  transfer  function  gives  the  system  output: 


Output  =  (TransferFunction)  Input 

(59) 

Transfer  Function  =  ^utPut 

(60) 

Input 

The  two  most  common  outputs  from  the  FFT  analyses  are  a  PSD  of  individual  signals,  and  either  Bode  or 
Nyquist  plots  of  amplitude  and  phase  relationships  between  two  signals.  The  PSD  is  used  to  examine  the 
frequency  content  of  a  signal  and  the  Bode  or  Nyquist  plots  are  used  to  analyze  the  frequency  response  of  a 
transfer  function.  The  PSD  plots  can  be  used  to  examine  the  frequency  content  of  a  signal  for  such  analyses 
as  determining  appropriate  filtering,  identifying  structural  or  other  modes  in  the  data,  identifying  noise 
characteristics  and  aliased  signals.  The  Bode  and  Nyquist  plots  are  often  used  to  compare  the  actual  system 
response  for  key  handling  qualities  transfer  functions  to  published  criteria  These  criteria  are  often 
represented  in  the  frequency  domain,  and  FFT-type  analyses  allows  direct  comparison  to  the  criteria.  This 
is  often  preferable  to  the  alternative  of  using  aerodynamic  parameter  identification  combined  with  FCS 
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models  to  generate  the  desired  Bode  or  Nyquist  plots  for  comparison.  The  FFT  method  is  a  direct 
measurement  and  reduces  the  impacts  of  modeling  errors. 

The  transfer  function  method  has  also  been  used  to  determine  pseudo  open-loop  stability  margins  during 
envelope  expansion.  The  method  is  labeled  as  a  pseudo  open  loop  since  the  loop  is  not  truly  opened,  but 
instead  is  manipulated  in  a  fashion  to  derive  the  open-loop  characteristics.  Figure  20  shows  a  typical  set  up 
for  this  type  of  analyses. 


Figure  20  Typical  Closed-Loop  System  With  Sinusoidal  Input 


Reference  14,  Real-Time  Open-Loop  Frequency  response  Analysis  of  Flight  Test  Data,  gives  an  excellent 
overview  of  determining  pseudo  open-loop  stability  margins  from  flight  test  data.  This  method  is  applicable 
when  a  single  input  single  output  (SISO)  path  can  be  defined  within  the  FCS  to  apply  the  analyses.  For  the 
case  shown  in  Figure  20,  the  transfer  function  input  is  the  error  signal  and  the  output  is  the  feedback  signal. 
For  multiple  input,  multiple  output  (MIMO)  systems,  the  application  becomes  more  difficult.  A  classical 
example  of  this  would  be  in  the  lateral  directional  FCS  axis,  where  coupling  between  roll  and  yaw 
commands  and  feedbacks  are  common.  In  this  case,  the  commands  to  a  given  actuator  (i.e.,  rudder  or 
aileron)  are  often  used  as  the  summing  junction.  Comparison  would  then  be  made  with  predictions  which 
open  only  the  loop  in  question  with  all  other  loops  closed.  Care  must  be  taken  to  ensure  that  the  analyzed 
loops  from  flight  test  are  similar  to  those  used  for  the  predicted  characteristics.  The  technique  requires  that 
a  unique  input  signal  be  designed  to  produce  the  pseudo  open  loop  transfer  function  by  comparison  with  the 
command  and  feedback  paths.  Without  this  separate  signal  for  comparison,  the  signal  will  return  the  gain 
and  phase  characteristics  of  the  summing  junction.  This  also  implies  that  the  applicable  bandwidth  of  the 
analyses  will  depend  on  the  bandwidth  of  the  input  signal. 

The  input  signals  are  often  derived  from  high  bandwidth  maneuvers  such  as  target  tracking  or  other 
handling  qualities  tasks.  Maneuvers  such  as  HQDT  usually  provide  sufficient  bandwidth  to  obtain  closed 
loop  transfer  functions  pertinent  to  handling  qualities  criteria  comparison.  However,  pilot  bandwidth  is 
limited  to  a  maximum  of  approximately  30  radians  per  second  with  less  than  20  radians  per  second  the 
norm.  If  higher  bandwidths  are  desired,  then  some  other  type  of  input  besides  that  generated  by  the  pilot 
may  be  required.  The  automatically  generated  swept  sine  sweep  is  often  used  to  provide  the  input  signal  for 
frequency  response  analyses.  The  swept  sine  sweep  is  usually  generated  from  special  flight  test  function 
generator  and  combined  directly  into  the  FCS  at  appropriate  junctions  for  the  analyses  desired.  This 
technique  will  not  provide  a  direct  measurement  of  the  pilots  input  at  the  stick  or  rudder  pedals.  For 
analyses  requiring  this  input,  a  pilot  induced  swept  sin  sweep  is  generally  used.  The  frequency  content, 
magnitude  and  duration  of  the  preprogrammed  swept  sine  sweep  should  be  optimized  from  simulation  tests 
combined  with  an  FFT  analyses  routine.  The  piloted  swept  sin  sweep  should  also  be  practiced  in  the 
simulation  to  ensure  adequate  content  and  duration. 

5.3.10  Trajectory  Reconstruction 

Trajectory  reconstruction  is  a  postflight  simulation  technique,  similar  to  aerodynamic  parameter 
identification,  which  attempts  to  define  the  best  estimate  of  the  true  aircraft  trajectory  (states  and  outputs) 
based  on  flawed  measurements.  The  technique  estimates  the  true  trajectory,  the  measurement  errors  and 
provides  kinematically  consistent  aircraft  states  and  outputs  for  other  analyses.  It  can  also  be  used  to 
estimate  states  or  outputs  which  are  not  directly  instrumented.  Reference  15,  Identification  of  the 
Aerodynamic  Model  of  the  DLR  Research  Aircraft  (ATTS)  for  Flight  Test  Data,  gives  information  on  the 
trajectory  reconstruction  process. 
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Trajectory  reconstruction  integrates  the  aircraft  equations  of  motion  driven  by  flight  test  measured  inputs  to 
derive  the  estimated  states.  Rather  than  use  aircraft  control  inputs  and  an  aerodynamic  model  to  drive  the 
equations  of  motion,  trajectory  reconstruction  directly  uses  measured  accelerations  and  axis  rates  as  inputs. 
The  equations  of  motion  can  be  formulated  to  use  accelerations  and  rates  as  inputs  as  opposed  to 
aerodynamic  or  thrust  generated  forces  and  moments.  Trajectory  reconstruction  requires  a  postulated 
measurement  error  model  to  estimate  parameter  errors.  Combining  these  into  a  simulation  and  parameter 
estimation  routine  allows  for  an  estimation  of  the  true  trajectory  of  the  aircraft. 

The  equations  of  motion  are  of  the  form: 


dx  , , _ x 

—  =  f(x,u,t ) 

y  =  g(x,u,t) 


(61) 


where: 


x  =  state  vector, 

U  —  input  Vector,  I  pmeasuredi  Qmeasuredx  ^measured]’  [N^measuredi  Ny  measureci,  Nzmeasure(j] , 

y  =  output  vector,  and 
t  =  time. 


Similar  to  the  parameter  estimation  case,  a  constant  vector  of  unknowns  and  a  scalar  cost  function  are 
defined; 


Me,  e2  .  en] 


(62) 


where: 


i  N 

&-P 


J=T>  HZ, 

l=l 


_  7 

i  measured  estimate 


_  7 

measured  i  estimate 


0  =  unknown  parameter  vector, 

J  =  scalar-cost  function, 

•^measured  =  vector  of  i'th  measurement, 

Zjmeasured  =  vector  of  i'th  estimated  measurement, 
R  =  measurement  covariance  matrix,  and 

I  =  index  of  measurements. 


(63) 


The  above  is  an  output  error  formulation.  The  trajectory  reconstruction  problem  can  also  be  formulated  in  a 
filter  error  or  Kalman  Filter  approach.  The  Kalman  Filter  approach  is  especially  well  suited  for  the 
trajectory  reconstruction  problem. 

Trajectory  reconstruction  differs  from  aerodynamic  parameter  estimation  in  the  form  of  the  measurement 
model.  For  trajectory  reconstruction,  an  attempt  is  made  to  model  all  of  the  errors  in  the  instrumentation 
system,  then  identify  these  errors  as  the  unknown  parameters.  The  estimated  measurement  model  is  often 
set  up  as  a  simple  bias  and  slope  model; 


measured  estimate 


~  (1  +  k  W estimate  +  Ybias  ) 


(64) 
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where: 

Z  measured  estimate 
k 

Y  estimate 

Y  bias 


estimated  measurement, 

scalar  error  in  the  measurement, 
estimated  true  value,  and 

bias  in  the  measurement. 


The  measurement  model  can  also  include  more  complicated  models  such  as  off  eg  corrections  to 
accelerometers  and  vanes  and  sensor  misalignments.  Trajectory  reconstruction  attempts  to  match  the  actual 
measurements  while  identifying  the  model  errors.  Since  the  estimated  measurement  model  is  a  function  of 
the  estimated  states  and  outputs,  when  convergence  occurs,  the  estimated  states  and  outputs  are  assumed  to 
be  the  best  estimates  of  the  actual  states  and  outputs. 

Trajectory  reconstruction  is  often  recommended  prior  to  performing  aerodynamic  parameter  identification. 
This  is  particularly  true  of  the  equation  error  methodologies.  Both  the  output  and  filter  error  techniques 
allow  for  a  formulation  of  the  measurement  equations  similar  to  that  used  for  trajectory  reconstruction,  thus 
allowing  the  reconstruction  to  be  accomplished  at  the  same  time  as  the  parameter  estimation.  The  equation 
error  method  depends  heavily  on  knowing  the  states  and  state  rates  of  the  system.  Use  of  trajectory 
reconstruction  can  allow  for  the  use  of  estimated  states  and  state  rates,  which  have  lower  uncertainty  levels 
than  direct  but  corrected  measurements  (corrected  by  methods  in  described  above).  The  methodology  can 
also  produce  estimated  trajectories,  which  have  higher  uncertainty  than  the  direct,  corrected  measurements. 

5.4  Data  Analyses  Flow 

5.4.1  General 

Much  of  the  philosophy  described  in  this  paper  relies  heavily  on  data  analyses  as  the  program  progresses.  A 
smooth,  responsive  analyses  process  is  required  in  order  for  the  predict,  test,  update,  and  validate 
philosophy  to  provide  significant  benefits.  As  with  all  other  aspects  of  testing,  early  development  and 
checkout  of  the  data  analyses  system  is  essential  to  ensure  that  the  proper  data  are  available  when  needed 
during  the  execution  of  the  test  program.  Failure  to  properly  plan,  develop,  and  test  the  data  acquisition  and 
analyses  systems  is  one  of  the  most  common  stumbling  blocks  encountered  during  flight  test  program 
execution.  Insufficient  planning  and  development  in  this  area  can  lead  not  only  to  significant  slowing  of  the 
test  objective  accomplishment,  but  can  also  have  adverse  safety  implications. 

5.4.2  Data  Flow  Planning 

Figure  21  describes  a  basic  data  flow  process  from  acquisition  onboard  the  aircraft  to  the  final  analysis 
results.  There  should  be  a  detailed  data  analyses  plan  developed  for  each  discipline,  and  then  an  overall 
plan  for  all  disciplines.  The  data  analyses  planning  is  as  important  as  the  flight  test  planning  and  should  be 
worked  early  enough  to  allow  for  system  development  and  testing  prior  to  the  execution  of  the  flight  test 
program. 


Test  Objectives  Safety  Objectives  Previous  Results 

Figure  21  Typical  Data  Analyses 


The  data  from  the  aircraft  are  converted  from  raw  measurements  (e.g.,  voltages  and  frequencies)  to  usable 
engineering  units,  then  the  appropriate  corrections  (e.g.,  position  error,  accelerometers  off  eg,  and  AOA 
vane  corrections)  are  accomplished,  derived  parameters  are  computed  (e.g.,  weight,  eg,  and  inertias)  and 
then  the  data  are  sent  to  discipline-specific  analysts  and  the  test  team.  The  analysts  and  test  team  then 
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perform  further  analyses  based  on  the  test  and  safety  objectives  as  well  as  prior  test  results.  The  flow  chart 
of  Figure  21  should  be  replicated  and  further  detail  included  for  each  specific  engineering  discipline  as  part 
of  the  test  planning  process.  The  detail  should  extend  to  the  accuracy  and  calibrations  for  the  on  aircraft 
sensors,  detailed  analyses  routines  for  corrections  and  test  and  safety  objective  accomplishment.  The  level 
of  detail  should  include  equations,  software  specifications  and  types  of  simulation  required.  As  with  the 
flight  test  plan,  the  data  analyses  plan  must  be  flexible.  The  test  team  must  be  prepared  to  modify  the  plan 
and  systems  necessary  to  achieve  the  flight  test  objectives. 

5.4.3  Data  Flow  Testing 

Equally  important  as  the  data  analyses  planning  process  is  the  algorithm  testing  process.  Data  acquisition 
and  analyses  systems  require  developmental  testing  just  as  any  other  engineering  system.  This  includes 
feedback  of  test  results  into  the  planning  and  development  of  the  system  as  is  shown  in  Figure  22. 


Test  Objectives 


Safety  Objectives 


Figure  22  Analysis  System  Test  Process 

One  of  the  most  common  mistakes  is  to  underestimate  the  time  and  resources  required  for  developing  and 
testing  the  data  analyses  system.  As  a  consequence,  the  data  analyses  system  testing  often  gets  short 
changed  as  the  basic  development  takes  longer  than  anticipated  and  the  actual  flight  portion  of  the  test 
program  nears.  The  test  team  must  ensure  that  adequate  and  timely  resources  are  put  toward  the 
development  of  the  data  analyses  system  to  ensure  an  adequate  process  such  as  that  indicated  in  Figure  22 
is  accomplished. 

One  of  the  biggest  problems  in  applying  a  data  analyses  system  test  process  is  obtaining  input  data  for  the 
systems  testing,  especially  since  there  may  not  be  any  aircraft  data  available.  There  are  several  sources  for 
obtaining  data  for  the  testing  portion  of  the  development.  Previous  flight  tests  on  like  or  similar  aircraft  can 
provide  one  source.  Another  source  is  to  model  the  potential  corrections  (e.g.,  position  errors,  off  eg 
accelerometers,  and  vane  indicated  angles)  in  the  simulator  and  use  simulation  data.  These  data  may  be 
intentionally  corrupted  with  noise  and  also  modified  to  indicate  off  predicted  performance  in  order  to  more 
accurately  reflect  actual  flight  data.  Such  data  can  be  routinely  captured  during  other  planning  uses  of  the 
simulation.  However,  this  capability  requires  advanced  simulation  planning  in  order  to  modify  the 
simulation  to  provide  the  needed  data. 

The  onboard  aircraft  portion  of  the  acquisition  system  should  be  tested  as  soon  as  components  of  the 
system  are  available  and  continue  until  installed  in  the  aircraft.  Actual  recording  and  telemetering  can  be 
tested  to  some  extent  on  the  ground  before  flight;  however,  the  final  test  is  usually  the  first  few  flights.  One 
of  the  areas  where  future  modeling  and  simulation  efforts  may  be  of  large  benefit  is  in  modeling  the  on- 
aircraft  portion  of  the  data  system.  As  research  and  development  continues  in  the  modeling  and  simulation 
field  concerning  electronic,  software  and  spectrum  transmission  systems,  the  results  may  provide  a  huge 
benefit  into  developing  the  on-aircraft,  recording,  and  telemetering  portion  of  the  data  acquisition  and 
analyses  systems. 

Another  factor  in  reducing  the  amount  of  development  and  testing  time  for  the  data  analyses  system  is  to 
use  tested  and  validated  algorithms.  Most  flight  test  organizations  have  a  reuse  policy  in  place  in  order  to 
reduce  the  overall  data  acquisition  and  analyses  development  time  and  cost.  One  of  the  historical  problems 
with  reuse  libraries  has  been  in  maintenance  and  modernization.  Any  such  library  needs  constant 
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maintenance  and  modernization  such  that  it  can  keep  up  with  the  demands  of  changing  technology.  Legacy 
hardware  and  algorithms  can  quickly  become  outdated  in  today's  fast  changing  computer  environment. 
Failure  to  maintain  and  modernize  reuse  libraries  and  systems  may  negate  the  benefits  of  said  systems. 

5.4.4  Data  Analyses  Flow  Execution 

Once  the  full  development  cycle  for  the  system  as  indicated  in  Figure  21  has  been  accomplished,  and  the 
initial  flight  tests  indicate  that  the  system  is  working  properly,  then  it  is  ready  for  production  use.  The 
primary  objective  of  any  data  analyses  system  is  to  obtain  and  analyze  the  data  as  quickly  as  possible.  The 
pace  of  the  flight  test  program  is  often  dictated  by  the  pace  of  the  applicable  data  analyses.  A  validated, 
efficient  and  timely  data  analyses  flow  is  required  for  any  flight  test  program  to  proceed  on  schedule  and 
within  budget.  Required  data  analyses  should  be  prioritized  with  respect  to  criticality  relative  to  the  current 
testing.  The  data  analyses  needs  to  be  prioritized  such  that  critical  information  is  readily  available,  while 
less  critical  is  done  at  some  future  date.  This  will  be  an  ever-changing  process  as  current  test  results  will 
dictate  changing  prioritization.  The  test  team  must  remain  flexible  in  their  analysis  prioritization.  Another 
way  of  significantly  speeding  up  the  analysis  cycle  is  to  perform  as  much  of  the  analysis  in  real  time  as 
possible.  This  is  becoming  increasingly  technically  feasible  as  computer  systems  grow  almost 
exponentially  in  capability.  Designing  the  system  such  that  many  of  the  corrections  and  detailed  discipline 
analysis  can  be  conducted  in  real  time  or  near  real  time  (soon  after  collection  or  maneuver  execution)  will 
have  a  large  beneficial  impact  on  test  efficiency  and  safety. 

5.5  Data  Tracking  and  Databases 

5.5.1  General 

Large  amounts  of  data  are  typically  collected  during  the  course  of  a  DFCS  flight  test  program. 
Furthermore,  the  final  reporting  may  not  take  place  until  years  after  the  start  of  the  test  program.  Both  of 
these  circumstances  require  that  the  data  collected  be  thoroughly  catalogued  and  easily  retrieved.  This 
requires  a  sophisticated  data  tracking  and  databasing  system.  The  job  is  made  easier  by  taking  advantage  of 
commercially  available  software  specifically  designed  for  data-tracking  and  databasing.  The  importance  of 
a  databasing  and  tracking  system  cannot  be  over  emphasized. 

5.5.2  Data  Tracking 

Data  tracking  is  the  process  of  tracking  what  maneuvers  have  been  performed,  what  data  were  collected 
and  what  the  quality  of  the  data  were.  This  information  is  essential  in  tracking  test  objective  progression 
and  in  defining  any  needed  retest.  When  large  amounts  of  data  are  collected,  it  is  easy  to  lose  track  of  what 
has  been  accomplished  and  what  data  are  available.  A  user  friendly  data-tracking  system  is  required  in 
order  to  manage  the  test  plan,  program  progress  and  data  analyses. 

The  tracking  system  should  identify  the  specific  test  points,  their  relationship  to  the  test  plan  and 
information  on  maneuver  and  instrumentation  quality.  It  should  also  contain  information  concerning  test- 
point  completion.  Completion  should  be  defined  as  sufficient  quantity  and  quality  of  data  available  in  order 
to  consider  the  point  accomplished  relative  to  its  relationship  to  the  test  objectives.  The  test  team  should 
avoid  labeling  a  test  point  complete  simply  by  having  performed  it  on  a  mission.  Sufficient  analysis  must 
be  completed  to  ensure  that  the  data  quality  and  quantity  standards  are  met.  The  data  tracking  system 
should  be  automated  as  much  as  practical,  although  complete  automation  is  not  possible.  Any  system  will 
require  inputs  from  the  test  team  as  to  whether  the  individual  test  point  is  complete.  The  system  should  also 
be  capable  of  interfacing  with  the  databasing  system  to  ensure  that  the  final  stored  information  on  any 
given  point  is  up  to  date  and  complete. 

5.5.3  Databasing 

Databasing  is  the  actual  storage  for  later  retrieval  and  use.  As  with  data  tracking,  the  accumulation  of  large 
amounts  of  data  makes  it  easy  to  lose  track  of  what  data  are  available,  what  file  names  they  are  stored 
under,  and  what  conditions  they  represent.  A  well-designed  databasing  system  will  make  the  access  and  use 
of  the  data  more  efficient.  Many  past  test  programs  have  collected  rooms  full  of  data,  but  have  developed 
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no  system  for  cataloguing  these  data.  As  a  consequence,  much  of  the  data  has  become  useless  since  there  is 
no  documentation  as  to  specifically  what  the  data  represented.  A  usable  databasing  system  needs  to  not 
only  store  the  pertinent  data  for  analyses,  but  also  have  higher  level  information  concerning  the  flight 
number,  specific  maneuver,  what  is  the  flight  condition  and  configuration,  and  whether  or  not  the  data 
quantity  and  quality  are  sufficient  to  support  the  test  objectives.  These  higher  level  data  are  similar  to  those 
required  for  the  data  tracking  system,  hence,  the  need  for  an  interface  between  the  two  systems. 

The  system  needs  to  be  user  friendly  and  readily  accessible  by  the  entire  test  and  analysis  team  as  well  as 
outside  sources.  It  also  needs  to  be  capable  of  storing  and  tracking  all  analysis,  from  the  engineering  units 
conversion  to  the  final  reporting  data.  This  should  include  not  only  time  history  data,  but  also  detailed 
analysis,  charts,  intermediate  analysis  and  the  algorithms  used.  It  should  be  possible  to  track  the  entire 
analysis  trail  via  the  databasing  system.  Without  these  capabilities,  the  management  of  large  amounts  of 
data  collected  in  modern  DFCS  test  programs  is  extremely  difficult,  if  not  impossible. 

The  test  team  should  start  planning  the  databasing  system  early  in  the  test  planning  process.  There  are 
many  commercial  and  independently  developed  databasing  systems  available  in  today’s  market  which  have 
the  required  capability,  so  a  large  databasing  system  development  program  is  not  always  required.  The  test 
team  needs  to  define  the  databasing  requirements  early  and  investigate  the  needs  for  procurement  or 
development  early  in  the  test  planning  process. 

6.0  CONCLUDING  REMARKS 

This  document  has  covered  a  wide  range  of  subjects  which  are  applicable  to  the  flying  qualities  flight 
testing  of  DFCS.  By  necessity,  the  technical  depth  and  disciplines  involved  in  testing  such  systems  covers  a 
wide  range  of  specialties.  The  job  of  flight  testing  a  DFCS  is  really  that  of  a  systems  development  and 
integration  problem.  The  DFCS  depends  on  many  other  aircraft  characteristics,  systems,  and  subsystems  in 
order  to  operate  properly  and  perform  its  intended  mission.  Each  must  perform  adequately  in  order  for  the 
entire  DFCS  to  properly  operate. 

This  report  has  covered  specific  areas  deemed  especially  important  by  the  author,  specifically,  the  test 
preparation  and  data  analyses  sections.  Proper  preparation  and  data  analyses  are  cornerstones  of  any 
successful  flight  test  program,  and  as  such  have  been  given  broad  attention  in  this  report.  In  addition,  the 
consequences  of  potential  mistakes  while  testing  a  DFCS  can  be  disastrous,  leading  to  loss  of  aircraft  or 
life.  Since  this  type  of  flight  testing  is  often  hazardous,  it  is  incumbent  on  the  test  team  to  carefully  plan  and 
execute  the  program.  The  test  team  must  be  knowledgeable  about  what  the  aircraft  is  predicted  to  do,  what 
it  is  doing,  and  the  reasons  for  both.  Armed  with  this  knowledge,  the  DFCS  flight  test  team  can  make  the 
appropriate  decisions  required  during  the  execution  of  the  test  program.  Without  minimizing  the  other  areas 
involved,  the  author  believes  that  preparation  and  data  analyses  are  the  two  most  important  aspects  of 
testing  hence  the  emphasis  on  these  areas. 

Lastly,  the  procedures  and  practices  presented  in  this  report  are  a  compilation  of  best  practices  as  learned 
over  the  years  by  the  test  community.  They  certainly  are  neither  exhaustive  nor  all-inclusive,  simply  a  list 
of  perhaps  the  most  commonly  used  practices.  There  never  has  been,  nor  will  there  ever  likely  be,  a  test 
program  where  it  is  possible  or  practical  to  employ  all  of  the  practices  discussed  in  this  report.  However,  it 
is  hoped  that  the  target  audience  will  find  many  of  the  practices  applicable  to  their  test  programs  and  be 
able  to  improve  both  test  efficiency  and  safety  as  a  result. 
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1.0  FRENCH  EXPERIENCE 

In  France,  studies  into  digital  flight  control  systems  began  in  1970.  Prior  to  that  date,  aircraft  such  as  the 
Mirage  III  and  IV  had  conventional  hydromechanical  flight  control  system  (FCS)  with  simplex  analogue 
limited  authority  autostabilizers  to  augment  basic  handling  qualities. 

The  move  to  multiplex  analogue  FCS  resulted  in  the  Balzac  V  and  Mirage  III-V  being  equipped  with 
triplex  analogue  augmentation  systems.  A  Mystere  20R  was  used  as  a  full  6  axis  in-flight  simulator  in  a 
supporting  research  and  development  program.  By  the  1970’s,  the  Mirage  G  and  G8  were  flying  with  full 
authority  multiplex  analogue  FCS. 

By  the  late  1970’s,  research  using  the  Mystere  20R  had  resulted  in  the  development  of  a  hybrid 
digital/analogue  FCS  for  the  Mirage  2000,  4000  and  3NG  aircraft.  The  digital  functions  involved 
elaboration  of  gains  and  air  data  computation  but  the  FCS  was  fundamentally  a  quadruplex  analogue 
system. 

In  the  mid- 1 980’ s  a  development  of  the  Mirage  2000  known  as  the  M2000  NUM  was  planned  whereby  the 
essentially  analogue  FCS  was  to  be  replaced  by  a  full  authority  digital  system  to  be  fitted  to  the  second 
prototype  M2000.  This  project  proceeded  to  the  bench  test  phase  but  never  flew.  The  project  was  overtaken 
by  the  Rafale  A  program  and  terminated  when  the  second  prototype  M2000  was  written  off  in  an  accident. 

The  Rafale  A,  which  first  flew  in  July  1986,  was  a  technology  demonstrator  with  the  additional  task  of 
optimizing  the  aerodynamic  configuration  for  the  full  Rafale  development  program.  It  was  the  first  French 
aircraft  with  full  authority  digital  FCS.  The  main  Rafale  flight  test  program  commenced  in  1991  with  the 
first  flight  of  the  Rafale  C.  This  was  followed  by  the  Rafale  M  and  B  variants. 

The  Rafale  FCS  is  a  full  authority  digital  system  in  a  longitudinally  unstable  aerodynamic  configuration. 
The  FCS  was  designed  to  control  an  aerodynamic  configuration  that  was  optimized  from  aerodynamics, 
buffet,  lift,  drag,  structural  loads,  and  control  surface  loads  considerations. 

The  FCS  functionality  provides  6  axis  stability  augmentation  on  ground  and  in  the  air  including  gust 
alleviation.  Handling  qualities  are  optimized  to  give  carefree  handling  and  structural  protection  by 
controlling  incidence  sideslip,  normal  acceleration,  roll  rate  and  roll  acceleration.  Autopilot  functions  are 
included,  which  utilize  novel  inceptors  such  as  brake  pedals  to  provide  input  commands. 

The  FCS  processes  all  the  air  data  sensor  inputs  and  is  integrated  with  the  avionic  and  weapon  delivery 
systems  in  the  provision  of  general  navigation,  terrain  following,  auto  approach  and  landing  (for  both  land 
and  carrier  based  operations),  and  auto  weapon  delivery  functions. 

The  FCS  was  designed  with  the  safety  specification  requirement  for  a  failure  rate  better  than  10'^  per 
flying  hour.  This  requirement  included  the  FCS,  hydraulics,  and  electrical  supply  system.  The  redundancy 
of  the  system  is  either  quadruplex,  triplex,  or  duplex  depending  upon  the  criticality  of  the  subsystem.  For 
example,  quadruplex  functions  include  inertial  sensors,  actuator-loop  control,  and  moding  status  whereas 
air  data  is  triplex. 

Digital  computing  is  triplex  with  duplex  analogue  backup  computing  and  duplex  interface  computing  for 
avionics,  weapon  system  bus  interfaces,  and  engine  control  computing.  Two  hydraulic  systems  plus  an 
electrohydraulic  pump  and  four  electrical  supplies  (of 

which  two  are  dedicated  to  the  FCS)  are  provided. 
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1.1  Flight  Clearance  Process 

The  methodology  used  for  critical  software  is  outlined  in  the  Figure  Al. 


Figure  Al  Critical  Software  Methodology 
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Flight  clearance  testing  was  performed  on  test  benches  that  could  be  linked  together.  A  full  Iron  Bird 
facility  was  not  used. 

For  flight  clearance  testing,  a  decision  was  taken  not  to  use  an  Iron  Bird,  but  to  use  a  series  of  test  benches 
that  could  be  used  in  isolation  or  linked  together.  This  was  considered  to  give  more  flexibility.  The  test 
benches  were  made  up  of  an  actuator  bench,  a  flight  control  computer  bench,  a  cockpit  mounted  in  a  dome 
simulation  facility,  and  a  simulation  computer  containing  both  the  aerodynamic  model  and  an  FCS  model. 
All  testing  was  accomplished  using  these  facilities.  Integration  testing  had  to  be  done  using  a  number  of 
different  facilities. 

The  fact  that  no  Iron  Bird  was  utilized  led  to  the  philosophy  of  partial  integration  testing  on  each  of  a 
number  of  different  system  test  facilities.  Thus  to  ensure  full  integration  across  all  systems,  an  overlap 
philosophy  was  used  to  ensure  a  full-integration  assessment  before  equipment  was  fitted  to  the  aircraft. 

The  fundamental  clearance  philosophy  was  that  any  change  to  the  software  would  require  a  complete 
reclearance.  Thus  the  flight  development  test  plan  identified  a  series  of  phased  software  releases.  Each 
software  upgrade  contained  new  facilities  and  would  also  incorporate  any  changes  required  as  the  result  of 
flight  experience. 

1.2  Flight  Test 

Flight  test  engineers  and  pilots  were  involved  in  the  FCS  design  definition  stage  as  well  as  the  bench  test 
phase  leading  to  clearance  for  flight.  This  ensured  that  the  required  flight  test  facilities  were  provided 
within  the  FCS  functionality. 

1.3  Instrumentation 

Data  for  flight  test  instrumentation  (FTI)  is  obtained  from  the  FCS  with  typically  250-300  signals  being 
recorded.  In  order  to  maintain  system  integrity,  the  FTI  interfaces  with  only  1  flight  control  computer  flight 
control  computer  (FCC),  but  within  that  interface,  all  lanes  of  sensor  data  can  be  accessed.  The  FTI  also 
interfaces  with  the  data  buses  which  are  utilized  by  the  FCS  so  has  access  to  all  consolidated  FCS  data 
output  by  the  FCS. 

Although  FCS  data  are  32  bit,  only  the  most  significant  bits  are  transmitted.  Data  are  telemetered  for  a 
ground  display  and  recording  and  are  also  recorded  onboard  the  aircraft. 

1.4  FCS  Test  Facilities 


Test  facilities  are  provided  which  contain  a  number  of  functions.  These  are  comprised  of: 

a.  Low  frequency  test  input  to  cover  the  0  to  5Hz  range  for  aerodynamic  data  gathering  and  air  data 
calibration  purposes. 

b.  High  frequency  test  inputs  to  cover  the  range  5  to  50  Hz  for  structural  mode/flutter  testing. 

c.  Ability  to  vary  specific  gains  within  the  control  laws.  Only  a  very  small  number  of  gains  could 
actually  be  varied  (i.e.,  typically  slat  per  degree  AOA  and  stick  command  path  gains)  due  to  the  extensive 
impact  on  flight  clearance  requirements. 

1.5  Flight  Test  Philosophy 

The  basic  objective  of  the  flight  test  development  program  was  to  gather  data  that  enable  the  various 
models  used  in  the  design  process  to  be  adjusted  where  necessary  and  thus  validated.  A  step  by  step 
approach  was  used  such  that  functions  were  progressively  added  to  the  FCS  at  each  software  upgrade  and 
assessed/validated  in  flight  before  the  next  major  upgrade. 
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Where  functions  could  not  be  fully  tested  on  the  ground,  the  final  assessment  was  performed  in  flight.  The 
sidestick  controller  was  an  example  of  this.  Considerable  ground  testing  was  completed  prior  to  flight,  but  the 
final  assessment  could  only  be  covered  in  the  full-flight  environment. 

The  number  of  possible  FCS  failure  modes  (reconfigurations)  was  deliberately  kept  to  a  minimum  in  the 
design  phase  in  order  to  minimize  the  amount  of  ground  clearance  testing  and  flight  testing.  This  flight 
testing  of  failure  modes  was  limited  to  the  significant  reconfiguration  states  of  loss  of  incidence/sideslip 
date  and  reversion  to  analogue  backup  mode.  No  flight  assessment  of  failure  transients  by  injecting  failures 
was  planned  due  to  the  complexity  of  the  FCS.  All  such  failure  testing  was  performed  on  the  test  bench 

where  the  test  philosophy  required  an  assessment  of  all  failures  with  a  probability  greater  than  1  in  10'^  per 
flight  hour. 

1.6  Certification  Philosophy 

The  flight  test  process  was  to  be  used  to  demonstrate  compliance  with  the  specification  by  validating  the 
various  models  used  in  the  design  process  and  hence  supporting  predicted  performance  obtained  from  the 
theoretical  and  ground  test  results. 

1.7  Digital  FCS  Issues 

a.  Validation  of  software. 

b.  Possibility  of  using  software. 

c.  Very  strict  clearance  methodology. 
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1.0  INTRODUCTION 

The  final  proof  of  design  of  any  control  system  is  the  demonstration  of  successful  integration  of  the  control 
system  into  the  total  vehicle  of  which  it  is  a  part.  Such  a  demonstration  of  satisfactory  and  therefore  safe 
design  must  include  an  assessment  of  the  behavior  of  the  vehicle  and  its  control  system  over  the  full  range 
of  normal  and  extreme  environmental  conditions  to  which  it  will  be  subject.  Thus,  in  the  case  of  an  aircraft 
flight  control  system  (FCS),  this  can  only  be  achieved  by  testing  the  FCS  when  it  is  fully  integrated  into  the 
aircraft  and  assessing  it  over  the  full  operating  envelope  of  the  aircraft.  Flight  testing  represents  the  ultimate 
proof  that  the  design  of  the  FCS  is  both  fit  for  purpose  and  meets  the  design  requirements. 

Historically,  the  flight  test  process  has  been  viewed  as  an  independent  check  of  the  whole  aircraft  and  its 
systems  by  the  flight  test  team  of  pilots  and  engineers  whose  task  was  to  assess  the  aircraft  behavior  and 
identify  any  problems  with  the  design.  Any  problems  identified  had  to  be  understood  and  resolved  by  the 
designers,  and  then  the  modified  aircraft  reassessed  by  the  flight  test  team.  Up  to  the  1950's,  the  amount  of 
flight  data  obtained  from  test  flights  was  comparatively  small  and  was  made  up  of  a  combination  of  pilot’s 
notes  (on  a  kneepad),  photographs  of  banks  of  gauges,  and  data  recorded  on  ultraviolet  trace  recorders  that 
typically  would  record  10  parameters  per  recorder.  Extraction  of  data  from  these  sources  were  both  labor 
intensive  and  time  consuming  so  flight  test  programs  would  extend  over  many  years.  The  general  test 
philosophy  for  a  new  aircraft  design  was  to  build  a  number  of  prototypes  and  fly  as  much  as  possible  over  a 
wide  range  of  conditions  in  order  to  demonstrate  freedom  from  problems  and  good  overall  behavior.  From 
a  flight  test  point  of  view,  the  1950’s  and  1960’s  was  a  period  of  rapid  technological  advance  and  this, 
coupled  with  the  continual  drive  for  improved  aircraft  performance,  led  to  many  new  problems  being 
encountered.  This  inevitably  resulted  in  incidents  or  accidents  with  a  number  of  aircraft  being  lost  and  test 
pilots  being  killed  or  seriously  injured. 

When  problems  were  encountered,  further  detailed  flight  testing  had  to  be  made  in  order  to  gain  an 
understanding  of  the  problems.  The  designers  would  attempt  to  generate  fixes  to  solve  each  problem.  Such 
fixes  then  had  to  be  fully  flight  tested  to  determine  their  success  or  develop  and  flight  clear  a  final  fix  that 
gave  acceptable  characteristics.  Over  this  period,  aircraft  flight  control  systems  progressed  from 
comparatively  simple  systems  with  cables  or  rods  connecting  the  pilots’  controls  to  the  control  surfaces,  to 
more  complex  power  assisted  systems.  As  the  combat  aircraft  flight  envelope  increased,  control  surface 
loads  increased  to  the  extent  that  hydraulic  actuators  were  necessary  to  assist  and  eventually  replace  the 
pilot  control  forces.  This  in  turn  led  to  the  requirement  for  artificial  feel  systems  to  give  the  pilot  the  correct 
cues  in  terms  of  control  forces.  As  the  quest  for  improved  performance  continued,  the  aerodynamic 
characteristics  of  new  aircraft  became  more  complex  and  it  became  progressively  more  difficult  to  produce 
satisfactory  handling  characteristics  by  aerodynamic  means  alone.  Autostabilizers  were  introduced  to 
improve  the  poor  natural  damping  of  the  aircraft,  but  since  these  were  simplex,  they  could  only  be  of 
limited  authority  in  order  to  survive  in-flight  autostabilizer  failures.  Autopilot  functions  were  also  included 
and  utilized  as  either  dedicated  autopilot  actuators  or  the  autostabilizer  subactuators  in  order  to  introduce 
the  autopilot  demands  on  to  the  control  surfaces.  The  correct  behavior  of  these  systems  had  to  be  assessed 
in  flight  and  so  the  flight  test  program  had  to  include  testing  in  both  the  normal  failure  free  state  and  in  each 
of  the  possible  failure  modes.  In  addition,  system  failure  testing  had  to  be  performed  in  flight  because  loss 
of  a  system  could  result  in  potentially  hazardous  conditions.  For  example,  loss  of  an  autostabilizer  function 
or  loss  of  a  hydraulic  system,  in  certain  parts  of  the  flight  envelope,  could  produce  a  significant  transient 
aircraft  response  or  degrade  the  aircraft  handling  qualities  to  the  extent  that  control  of  the  aircraft  could  be 
lost.  Such  in-flight  failure  testing  required  special  test  equipment  and  had  to  be  approached  and  conducted 
with  great  care.  For  example,  on  the  SEPECAT  Jaguar,  a  special  autostabilizer  failure  injection  unit  was 
fitted  to  inject  hard-over  or  null  failures  in  each  of  the  axes  of  the  3-axis  limited-authority  autostabilizer 
system.  Single  hydraulic  system  failures  were  simulated  in  areas  of  the  flight  envelope  where  high  actuator 
loads  were  experienced,  in  order  to  demonstrate  satisfactory  aircraft  behavior.  Such  testing  had  to  be 
performed  in  flight  because  of  the  relatively  low  level  of  confidence  in  the  mathematical  models  of  the 
aircraft  and  its  systems  at  that  time. 
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In  the  1960’s  and  early  1970’s,  technological  advances  took  place  that  were  to  significantly  impact  the 
flight  test  process.  These  advances  included  the  development  of  realistic  and  effective  flight  simulators;  the 
development  of  airborne  data  acquisition  and  telemetry  systems,  and  the  development  of  powerful  digital 
computers.  Such  computers  could  both  process  large  amounts  of  test  data  and  provide  the  ability  to  develop 
comprehensive  models  of  aircraft  aerodynamics,  structures,  and  individual  aircraft  systems.  These 
developments,  together  with  the  rapid  advances  in  the  field  of  electronics,  led  to  the  introduction  of  the 
concept  of  electrically  signaled  flight  control  systems,  that  is,  fly-by-wire  (FBW).  Since  control  of  the 
aircraft  is  a  fundamental  requirement  (i.e.,  the  FCS  is  a  safety  critical  function);  any  such  electrically 
signaled  system  must  be  fail  safe.  Thus  early  electrically  signaled  aircraft  FCS,  had  a  mechanical  backup 
mode  to  ensure  that  control  of  the  aircraft  would  not  be  lost  under  failure  conditions.  This  again  impacted 
the  flight  test  task  because  flight  testing  had  to  be  carried  out  in  all  possible  failure  modes  to  ensure  that  the 
aircraft  could  be  recovered  safely  when  failures  occurred.  Such  electrically  signaled  flight  control  systems 
were  multiplex  analogue  systems  and  the  Panavia  Tornado  is  typical  of  such  a  system.  The  Tornado 
command  stability  augmentation  system  (CSAS)  is  a  triplex  analogue  system  with  a  mechanical  backup. 
However,  the  increased  complexity  of  the  flight  control  system  meant  that  it  was  no  longer  feasible  to 
inject  worst  case  failures  in  flight  since  this  would  involve  a  failure  injection  device  interfacing  with  all 
lanes  of  the  multiplex  system.  Such  a  facility  would  have  to  be  multiplexed  in  order  to  ensure  that  failures 
within  the  injection  facility  did  not  hazard  the  aircraft.  Thus  failure  testing  was  done  on  a  realistic  flight 
controls  rig  as  described  in  more  detail  later  in  this  appendix. 

With  the  rapid  advances  in  microprocessor  technology,  the  move  towards  digital  FCS  became  feasible.  In 
addition,  studies  into  the  concept  of  active  control  technology  (ACT)  and  control  configured  vehicles  had 
indicated  that  there  were  significant  aerodynamic  and  structural  benefits  to  be  gained  if  these  concepts 
could  be  incorporated  into  future  combat  aircraft.  Such  a  step  forward  was  considered  so  significant  that  a 
number  of  research  programs  were  set  in  place  both  in  the  U.S.  and  in  the  United  Kingdom  (U.K.)  in  order 
to  safely  develop  such  systems.  The  first  U.K.  aircraft  with  a  full  authority  digital  FCS  was  the  FBW  Jaguar 
demonstrator  aircraft.  The  aim  of  this  national  research  program  was  the  design,  development,  and  flight 
demonstration  of  a  safe,  practical,  full-time  digital  FCS  for  a  combat  aircraft.  The  prime  objective  was  the 
identification  of  the  design  methodology  and  airworthiness  criteria  necessary  for  flight  certification  and 
throughout  the  program  the  FCS  was  to  be  treated  in  all  aspects  as  though  it  were  intended  for  production. 
Although  it  was  not  intended  to  demonstrate  the  aerodynamic  benefits  of  ACT,  the  program  included  flight 
demonstration  of  the  aircraft  in  a  configuration  that  was  aerodynamically  unstable  in  the  longitudinal 
(pitch)  axis,  and  demonstration  of  a  stall  departure  and  spin  prevention  system.  These  aspects  were 
considered  crucial  to  the  practical  realization  of  ACT.  It  was  also  decided  that  the  FBW  Jaguar  digital  FCS 
would  have  no  backup  flight  control  system  of  any  kind  from  the  outset  of  the  program.  The  reason  for  this 
was  twofold.  Firstly,  a  mechanical  system  could  not  control  an  unstable  configuration.  Secondly,  an 
independent  electrical  backup,  whether  analogue  or  digital,  would  introduce  so  much  additional 
complexity,  both  in  the  design  of  the  system  (hardware  and  software)  and  in  the  flight  clearance  processes, 
that  it  would  be  counter  productive.  From  the  flight  test  point  of  view  any  such  backup  system  would 
almost  certainly  have  to  be  tested  in  flight  with  all  the  associated  hazards  that  this  would  involve.  In  the 
event,  the  decision  to  have  no  back  up  system  was  fully  justified  since  other  demonstrator  programs  (e.g., 
the  U.S.  (AFTI)  F- 16)  had  significant  problems  with  their  backup  systems. 

The  FBW  Jaguar  program  provided  the  UK  with  the  vehicle  to  develop,  in  a  cautious  step  by  step 
approach,  the  ground  and  flight  test  clearance  methodology  necessary  for  a  digital  FCS  equipped  aircraft. 

As  a  research  program,  the  FBW  Jaguar  ground  and  flight  trials  were  an  outstanding  success.  The 
progressive  approach  provided  a  validated  set  of  design,  development,  ground  and  flight  test  techniques, 
and  procedures  that  could  be  used  as  the  basis  for  all  subsequent  UK  digital  FCS  programs.  Having  proved 
the  principles  of  the  digital  FCS  on  the  FBW  Jaguar,  the  way  was  open  to  fully  utilize  the  benefits  of  digital 
flight  controls  by  producing  an  aircraft  that  was  designed  from  the  outset  to  take  full  advantage  of  the 
benefits  of  active  control  technology.  That  aircraft  design  was  the  experimental  aircraft  program  (EAP) 
demonstrator.  The  objectives  of  this  program  were  much  wider  than  the  FBW  Jaguar  program  since  it  was 
to  bring  together  a  number  of  key  new  technologies  required  for  a  future  combat  aircraft.  However,  the 
digital  flight  control  system  was  crucial  to  the  success  of  the  aerodynamic,  structural,  and  avionic  design 
and  it  fully  utilized  the  experience  gained  from  the  FBW  Jaguar.  It  also  provided  a  major  challenge  to  the 
flight  test  process  and  herald  a  significant  change  to  the  philosophy  of  flight  trials.  Previous  UK  flight  trials 
programs  had  utilized  telemetry  to  monitor  each  test  flight,  both  from  a  trials  safety  point  of  view  and  to 
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improve  the  efficiency  of  flight  trials.  However,  most,  if  not  all,  of  the  test  analysis  was  performed 
postflight.  The  advances  in  computing  and  modeling  techniques,  which  had  enabled  the  realization  of 
digital  flight  controls,  also  made  possible  the  concept  of  in-flight  (real  time)  analysis  of  flight  test  data.  The 
EAP  demonstrator  program  provided  the  vehicle  for  the  development  of  real-time  analysis  techniques  for 
an  aircraft  with  a  digital  FCS  and  these  techniques  have  become  the  basis  for  flight  testing  the  latest 
European  combat  aircraft,  the  Eurofighter. 

2.0  PHILOSOPHY  OF  FLIGHT  TESTING 

As  already  indicated,  the  flight  trials  of  an  aircraft  represents  the  only  truly  valid  assessment  of  the 
performance  and  characteristics  of  the  FCS  in  the  total  vehicle  operating  in  its  true  element.  However,  the 
modem  digitally  controlled  aircraft  is  so  complex  that  the  flight  trials  now  represent  only  one  part  of  the 
assessment  of  the  aircraft  and  its  systems.  With  the  increasing  ability  to  accurately  model  both  the  aircraft’s 
aerodynamics  and  its  individual  systems,  the  flight  test  program  is  one  part  of  an  integrated  development, 
flight  clearance  and  flight  certification  program.  The  main  emphases  of  the  flight  trials  is  now  the 
validation  of  the  models  developed  in  the  design  and  initial  flight  clearance  of  the  aircraft  as  well  as  a 
demonstration  of  satisfactory  characteristics  throughout  the  flight  envelope  over  the  range  of  configurations 
and  roles  of  the  aircraft. 

As  a  consequence,  the  flight  test  task  begins  in  the  design  stage  of  the  program  and  continues  through 
simulation,  rig  test  and  aircraft  ground  test  before  proceeding  to  the  actual  flight  trials  phase. 

3.0  GROUND  TESTING 

In  order  to  understand  the  ground-test  process,  it  is  necessary  to  consider  what  actually  makes  up  the  FCS 
within  the  total  aircraft. 

The  vehicle  to  be  controlled  by  the  FCS  has  structural  and  aerodynamic  characteristics,  which  need  to  be 
defined  prior  to  flight  as  accurately  as  possible  as  a  prerequisite  for  the  FCS  design  process.  Theoretical 
methods  and  wind-tunnel  tests  of  physical  models  are  used  to  produce  the  structural  and  aerodynamic 
models  required.  These  models  need  to  be  verified  either  on  the  ground  or  in  flight.  Clearly  the 
aerodynamic  model  can  only  be  verified  in  flight  but  the  structural  model  can  be  partly  verified  on  the 
ground  and  so  ground  tests  are  performed  as  a  part  of  the  clearance  to  flight  process. 

The  FCS  requires  electrical  and  hydraulic  power  supplies  with  levels  of  integrity  comparable  to  that  of  the 
FCS  itself.  Electrical  equipment  requires  cooling  and  so  the  environmental  control  system  is  also  important 
from  an  FCS  point  of  view.  If  the  FCS  is  the  main  source  of  air  data  for  the  aircraft,  then  the  FCS  interface 
to  the  cockpit  displays  also  needs  to  be  of  high  integrity  to  ensure  that  the  pilot  always  has  the  flight 
reference  displays  that  are  required  (e.g.,  airspeed,  altitude,  Mach  number,  angle  of  attack  (AOA),  normal 
acceleration,  and  attitudes). 

The  FCS  itself  is  made  up  of  a  number  of  items  of  equipment.  The  heart  of  the  system  is  the  set  of  digital 
flight  control  computers  (FCC),  which  are  typically  quadmplex  (but  may  be  triplex).  These  computers 
interface  with  a  variety  of  input  sensors,  (pilot’s  controls,  stick,  pedal,  throttle  positions  and  a  variety  of 
switches),  inertial  sensors  (gyros,  and  accelerometers),  air-data  sensors  (pressures  and  flow  angles  to 
produce  airspeed,  altitude,  Mach  number,  AOA,  and  sideslip),  actuator  position  and  status  signals,  and 
signals  from  other  aircraft  systems  (e.g.,  weight-on-wheels  and  hydraulic  pressures).  The  outputs  from  the 
FCCs  are  the  actuator  command  and  control  signals  and  data  required  by  other  aircraft  systems  (i.e.,  air 
data  signals  for  pilot  displays  and  other  subsystems).  Each  set  of  sensors  and  interfaces  will  have  a  level  of 
redundancy  appropriate  to  the  requirement,  so  the  primary  FCS  sensors  will  again  be  quadruplex.  Within 
the  flight  control  computers  are  a  number  of  basic  functions  of  direct  interest  to  the  test  engineer.  These  are 
the  control  laws,  the  sensor  processing  functions,  the  actuator  interfaces  and  the  redundancy  management, 
failure  monitoring,  and  reporting  systems.  All  these  functions  must  be  fully  tested  on  the  ground  and  test 
facilities  are  required  to  achieve  this. 
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4.0  SIMULATOR  AND  RIG  TESTING 

The  control  laws  are  designed  and  developed  using  modeling  and  simulation.  The  design  process  requires 
both  aerodynamic  and  FCS  models.  The  FCS  model  contains  the  actuator,  sensor  and  computer 
hardware/software  characteristics  so  that  the  control  laws  can  be  designed  and  developed  for  the  real 
system,  (i.e.,  nonlinearities  and  computing  delays  are  included).  The  aerodynamic  models  have  a  measure 
of  uncertainty  at  this  stage  of  the  process  and  so  each  are  represented  by  a  nominal  model  together  with  a 
series  of  tolerances,  which  define  the  level  of  uncertainty  of  the  particular  aerodynamic  coefficients. 
Having  completed  the  initial  design  of  the  control  laws  using  unmanned  non  real-time  simulation,  the  full 
FCS  and  aerodynamic  models  are  installed  on  the  flight  simulator  for  evaluation  by  pilots  and  engineers. 
Clearly,  the  simulation  models  must  be  validated  against  the  design  models  to  ensure  correct 
implementation  onto  the  simulator,  which  may  have  its  own  set  of  time  delays. 

The  flight  simulator  contains  a  representative  cockpit  with  outside  world  display  to  enable  a  detailed 
assessment  of  the  control  laws.  This  assessment  is  carried  out  over  the  full  flight  envelope  for  nominal  and 
toleranced  aerodynamic  data  so  that  any  shortcomings  in  the  control-law  design  can  be  identified  and 
rectified.  This  assessment  can  often  be  an  iterative  process  as  problems  are  identified  by  pilots  and  referred 
back  to  the  control  law  designers.  The  control  laws  are  modified  and  reassessed  using  non  real-time 
simulation  before  the  updated  laws  are  passed  back  to  the  flight  simulator  for  pilot  re-assessment.  Once  a 
satisfactory  standard  is  obtained,  the  control  laws  are  released  for  coding  into  the  FCCs.  The  simulation 
task  does  not  end  at  this  point  but  moves  into  the  next  phase  where  it  is  used  to  perform  a  full  assessment  of 
the  control  laws  over  the  full  range  of  aircraft  configurations  planned  for  flight  assessment  in  order  to 
generate  a  flight  clearance  from  a  flight  mechanics  point  of  view. 

In  the  UK,  a  number  of  manned  simulation  facilities  have  been  used  for  the  control-law  design  process.  For 
example,  at  BAe  Warton,  a  number  of  general-purpose  simulators  are  available  and  the  initial  control-law 
design  assessment  can  be  performed  on  these  where  a  generic  cockpit  is  used.  The  detailed  control-law 
assessment  requires  a  more  representative  cockpit  particularly  in  terms  of  pilot  controls  so  this  may  be  done 
on  either  a  flight  simulator  specifically  configured  for  the  task  or  on  the  simulation  facility  contained  in  the 
FCS  rig  described  in  the  next  section.  The  advantage  of  the  general  purpose  simulator  is  the  very  high 
quality  of  both  the  outside  world  displays  and  the  computing  capabilities  contained  in  this  facility. 

The  FCS  equipment  is  tested  on  a  ground-test  rig.  The  rig  itself  can  be  as  representative  as  considered 
necessary  for  the  project  involved.  The  most  representative  rig  is  the  so  called  Iron  Bird  where  the  FCS  and 
all  the  interfacing  functions  replicate  the  aircraft  itself.  The  Iron  Bird  will  have  a  configuration  very  close 
to  the  aircraft  itself  with  the  control  surface  actuators  mounted  in  representative  structures.  All  the  cable 
runs  and  pipe  runs  will  utilize  aircraft  standard  equipment  and  will  be  run  and  mounted  in  a  representative 
way.  Aircraft  standard  electrical  and  hydraulic  supplies  will  be  utilized  and  the  equipment  racking  will  also 
be  representative  of  the  aircraft.  An  Iron  Bird  requires  a  considerable  investment  in  equipment  and  facilities 
and  in  the  U.K.,  recent  practice  has  been  to  utilize  a  test  rig  that  is  less  extensive  in  terms  of  representative 
aircraft  structure,  but  is  fully  representative  in  terms  of  the  FCS.  This  type  of  test  rig  is  made  up  of  a  series 
of  individual  test  benches,  which  can  either  be  used  independently  or  linked  together  to  provide  the 
complete  system.  It  will  also  have  all  the  interfaces  (either  real  or  simulated)  that  the  FCS  requires.  The  test 
rig  will  be  made  up  of  the  following  items: 

a.  FCC  test  bench, 

b.  Actuator  test  benches  containing  representative  mounting  structures  and  facilities  to  apply 
simulated  aerodynamic  loads, 

c.  Inertial  sensors  test  bench, 

d.  Air-data  sensors  test  bench, 

e.  Other  sensors  test  bench, 

f.  Simulation  benches  for  sensors  and  actuators, 

g.  Cockpit  with  all  FCS  related  equipment,  representative  flight  instruments,  and  realistic  outside 
world  display. 
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h.  Simulation  computer  capable  of  running  the  aerodynamic  model,  the  FCS  model,  and  any 
additional  model  functions  (e.g.,  undercarriage,  and  atmospheric  effects)  as  well  as  supporting  the 
cockpit  outside  world  display, 

i.  Real  or  simulated  engine  control  system, 

j.  Real  or  simulated  avionic  and  utilities  control  systems, 

k.  Hydraulic  and  electrical  supplies  capable  of  reproducing  the  aircraft  systems  in  terms  of  pressures, 
flows  and  redundancy,  and 

l.  Data  acquisition  and  analysis  system. 

Figure  B1  is  a  schematic  of  the  FBW  Jaguar  ground-test  rig  and  it  can  be  seen  that  a  high  level  of  flexibility 
is  provided  by  such  a  facility. 


B1  Schematic  of  FBW  Jaguar  FCS  Ground  Test  Rig 

Simultaneous  testing  can  be  carried  out  on  each  of  the  test  benches.  Alternatively,  different  groups  of 
benches  can  be  linked  with  simultaneous  testing  being  performed  on  each  of  these  groups.  Even  for  closed- 
loop  testing  (i.e.,  with  a  pilot  in  the  loop)  a  number  of  different  combinations  are  possible.  These  range 
from  pure  simulation  (  where  the  cockpit  is  linked  to  the  simulation  computer,  which  runs  models  of  the  full 
FCS  and  aerodynamics),  through  real  FCCs  with  simulated  actuators  and  sensors,  to  all  real  FCS  equipment 
with  the  simulation  computer  simply  closing  the  aerodynamic  loop.  This  level  of  flexibility  and 
simultaneous  test  capability  is  essential  if  the  large  amount  of  testing  required  to  clear  the  FCS  is  to  be 
accomplished  in  the  minimum  possible  time  period. 

The  principle  tasks  of  the  Rig  test  program  can  be  summarized  as  follows: 

a.  To  verify  the  control  laws  by  pilot  assessment  before  they  are  programmed  into  the  FCCs, 

b.  To  integrate  the  FCS  hardware  and  software, 
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c.  To  validate  the  software  actually  implemented  into  the  FCS, 

d.  To  integrate  the  FCS  with  other  aircraft  systems  including  the  flight  test  instrumentation  system, 

e.  To  gain  a  level  of  confidence  in  the  overall  system,  and 

f.  To  provide  a  facility  for  the  pilots  and  engineers  to  prepare  and  train  for  flight  Uials. 

4.1  Control  Law  Verification 

As  already  indicated  previously,  the  task  of  designing  and  verifying  the  control  laws  before  implementing 
them  in  the  FCCs  is  often  shared  between  the  general  purpose  simulators  and  the  ground-test  rig.  What  is  of 
vital  importance  is  that  the  models  used  on  both  facilities  are  both  identical  and  thoroughly  verified.  The 
standard  of  each  model  must  therefore  be  clearly  defined  and  tightly  controlled  using  a  master  data  file  that 
is  only  released  to  the  test  facilities  when  it  has  been  thoroughly  checked.  Once  installed  on  the  test  facility, 
check  cases  are  run  to  ensure  that  the  model  is  operating  correctly.  Any  change  to  the  models  is  first 
installed  and  checked  out  in  a  new  issue  of  the  master  data  file  before  being  formally  released  to  all  the  test 
facilities.  Only  in  this  way  can  it  be  ensured  that  the  correct  standard  of  model  is  used  to  verify  and  validate 
the  FCS  as  fit  for  flight. 

4.2  FCS  Hardware  and  Software  Integration  and  Testing 

The  ground  rig  provides  the  first  opportunity  to  run  the  FCS  equipment  together  as  a  full  set  of  hardware. 
Usually  the  standard  of  software  on  first  equipment  delivery  is  low  and  simply  enables  the  equipment  to  be 
powered  up  and  run  together.  As  each  software  function  is  implemented  it  is  thoroughly  checked  out  and 
debugged  where  appropriate  to  ensure  correct  implementation  and  operation.  The  built-in-test  (BIT) 
functions,  which  will  ultimately  require  a  full  set  of  FCS  equipment,  are  also  developed  to  ensure  that  they 
correctly  identify  all  conceivable  failure  scenarios.  The  individual  items  of  equipment  are  tested  on  their 
own  benches.  Thus  performance  testing  (e.g.,  frequency  and  transient  responses,  impedance  characteristics, 
and  rate  into  load  tests)  is  carried  out  on  each  of  the  actuators  mounted  in  representative  structures.  These 
results  are  used  both  to  confirm  that  the  actuators  meet  their  specification  and  to  update/validate  the 
actuator  models.  The  inertial  sensors  are  tested  on  rate  tables  and  the  pilot  inceptors  (e.g.,  control  stick  unit 
and  sensors,  rudder  pedal  assembly  and  sensors,  and  cockpit  switches)  are  tested  to  ensure  correct 
force/displacement  and  switching  characteristics. 

4.3  Software  Validation  Testing 

This  is  the  most  demanding  task  placed  on  the  rig  since  it  is  the  final  stage  of  an  extensive  software 
validation  process.  The  FCS  software  must  be  of  high  integrity  and  free  of  unacceptable  faults.  It  is 
therefore  subjected  to  a  series  of  tests  of  which  the  final  phase  is  carried  out  on  the  rig.  Before  the  formal 
rig  test  validation  process  can  begin,  the  delivered  software  must  shown  to  be  free  of  faults.  Thus,  as  each 
function  is  introduced  into  the  software,  it  is  fully  tested  and  any  shortcomings  are  corrected  with  software 
patches.  Once  a  satisfactory  standard  is  achieved,  a  formal  configured  standard  of  software  is  defined  and 
released  for  implementing  into  the  equipment.  The  formal  software  validation  testing  on  the  rig  can  then 
begin.  If  any  of  these  formal  tests  fail,  then  a  new  standard  of  software  must  be  produced  and  the  whole 
process  may  have  to  be  repeated. 

The  actual  formal  test  process  contains  the  following  aspects: 

a.  Initial  testing  to  ensure  all  previous  system  queries  have  been  cleared. 

b.  Initial  closed  loop  evaluation  where  the  rig  is  operated  closed  loop  using  real  FCCs  programmed 
with  the  formal  software.  This  evaluation  also  uses  all  other  appropriate  real  FCS  hardware.  An 
experienced  test  pilot  then  flies  a  series  of  flight  profiles  to  assess  aircraft  handling  and  system  behavior 
over  a  wide  range  of  flight  conditions  to  identify  any  deficiencies  and  to  give  early  warning  of  any  possible 
software  errors.  This  technique  has  been  shown  to  be  particularly  effective  in  identifying  potential  errors  in 
the  new  software  release.  Having  established  confidence  in  the  system  and  its  software,  the  full  detailed  test 
process  can  be  initiated. 
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c.  Full  evaluation  of  the  BIT  functions  to  ensure  no  self-detected  faults  exist  and  a  full  sequence  of 
failure  tests  to  ensure  that  the  BIT  correctly  detects  and  identifies  each  failure.  These  tests  are  of  particular 
interest  to  the  flight  test  engineers  because  the  design  of  an  FCS  is  such  that  any  BIT  failure  will  normally 
prevent  the  system  from  being  engaged  into  its  flight  mode.  Thus  the  engineers  need  to  understand  what 
can  cause  BIT  failures  and  the  differences  between  nuisance  and  hard  failures. 

d.  Open-loop  static  dynamic  and  transient  testing  to  ensure  that  the  end-to-end  characteristics  of  the 
system  are  correct.  In  this  configuration,  the  aerodynamic  loop  is  not  closed  (i.e.,  the  system  isopen  loop)  and 
each  sensor  to  surface  path  is  exercised  over  the  full  range  of  conditions.  Static  tests  confirm  correct  gains, 
dynamic  tests  check  gain  and  phase  over  the  range  of  frequencies  appropriate  and  the  transient  tests  check  the 
time  variant  aspects  of  the  different  paths  and  individual  control-law  elements.  The  results  of  each  of  these 
tests  are  compared  with  predictions  from  the  FCS  model.  Since  the  number  of  tests  can  be  of  the  order  of 
100000,  they  are  automated  as  far  as  possible  with  the  computer  comparing  each  result  with  an  acceptance 
band.  Only  when  a  test  fails  is  operator  intervention  required. 

e.  Synchronization  testing  to  ensure  that  the  system  obtains  synchronization  on  start  up  and 
maintains  or  reestablishes  synchronization  correctly. 

f.  Timing  testing  to  ensure  that  the  time  delays  through  the  FCS  meet  the  requirements  and  are 
correctly  represented  by  the  models. 

g.  Open-loop  failure  testing  to  ensure  that  the  failure  monitoring  functions  correctly  detect  and 
identify  each  different  type  of  failure;  that  the  voter  and  monitor  thresholds  and  timings  are  correct  and  the 
correct  system  reconfiguration  takes  place.  Again  this  testing  is  of  particular  interest  to  the  flight  test 
engineers  because  the  pilot’s  failure  drills  and  procedures  need  to  address  all  possible  failure  scenarios.  The 
correct  warnings  must  be  shown  to  be  generated  for  pilot  displays  and  correct  failure  information  generated 
for  the  failure  recording  and  maintenance  functions.  Other  aircraft  system  failures  or  specific  FCS 
equipment  hardware  failures  are  also  assessed  where  appropriate  to  ensure  correct  failure  detection  and 
system  performance/reconfiguration. 

h.  Closed-loop  dynamic  testing  with  the  simulation  computer  closing  both  the  aerodynamic  loop  and 
the  pilot  loop  to  perform  dynamic  and  transient  tests  the  results  of  which  are  compared  with  the  theoretical 
responses  obtained  from  the  model. 

i.  Closed-loop  failure  testing  to  ensure  that  when  single  or  multiple  failures  are  injected  into  the 
FCS,  any  transients  produced  are  at  an  acceptable  level  and  handling  qualities  remain  fully  acceptable 
following  any  FCS  reconfigurations.  For  this  testing,  the  rig  is  operated  fully  closed  loop  with  test  pilots  or 
experienced  test  engineers  flying  the  rig.  The  types  of  failures  and  the  flight  conditions  at  which  the  failures 
are  injected  are  defined  by  a  team  of  flight  test  and  aerodynamics  and  systems  engineers  to  ensure  that  all 
possible  failure  cases  are  included  and  the  worst  flight  conditions  and  system  configurations  are  assessed. 

j.  Closed-loop  handling  testing  to  ensure  that  the  handling  qualities  produced  by  the  control-laws 
software  actually  implemented  in  the  FCCs  is  identical  to  that  assessed  during  the  simulation  assessment 
and  clearance  process.  This  is  done  in  all  system  modes  and  over  the  full  range  of  mass  and  center-of- 
gravity  (eg)  positions  to  be  flown.  Also  included  are  assessments  of  the  FCS  behavior  following  other 
aircraft  system  failures.  For  example,  fuel  system  failures  can  result  in  large  eg  excursions  and  the  behavior 
of  the  FCS  in  these  conditions  can  be  assessed.  In  fact,  the  rig  can  be  use  to  assess  aircraft  and  real  actuator 
behavior  under  extreme  conditions  to  ensure  that  there  are  no  cliff  edges  present  that  could  result  in  loss  of 
the  aircraft  should  they  occur  in  flight. 

k.  Only  when  the  formal  software  tests  have  been  successfully  completed  can  partial  retests  be 
considered.  In  the  UK,  a  limited  change  clearance  process  was  developed  during  the  FBW  Jaguar  program. 
This  process  identified  the  minimum  amount  of  software  retesting  that  was  required  following  a  small 
change  to  a  fully  tested  standard  of  software.  The  process  has  proved  to  be  both  safe  and  efficient  in 
subsequent  UK  programs. 
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4.4  Inter-System  Integration  Testing 

The  FCS  will  interface  with  a  number  of  other  aircraft  systems  and  such  interfaces  may  be  hardwired  links 
or  data-bus  links. 

System  integration  testing  is  performed  to  confirm  correct  operation  of  each  of  these  interfaces  under 
normal  and  failure  conditions.  In  the  case  of  the  EAP  facility,  the  FCS  rig  was  capable  of  operating  with 
simulated  interfaces  for  the  majority  of  the  time,  but  a  series  of  tests  were  performed  with  the  FCS  rig 
linked  to  the  avionic  rig  and  the  utilities  systems  rigs  for  the  final  stage  of  the  integration  testing.  Other 
aircraft  programs  have  a  dedicated  integration  rig.  If  changes  are  made  to  the  software  or  hardware  in  either 
the  FCS  or  in  any  of  the  interfacing  systems,  appropriate  integration  testing  will  have  to  be  repeated. 

A  vital  part  of  the  flight  test  program  is  the  aircraft  flight  test  instrumentation  system  (FTI),  which  is  used 
to  record  the  data  required  for  analyses.  On  modern  aircraft,  the  majority  of  the  FTI  is  extracted  from  the 
various  data  busses  on  the  aircraft  and,  in  particular,  from  the  FCS.  Thus  the  FTI  FCS  interface  must  be 
thoroughly  tested  on  the  rig  to  ensure  correct  functioning  under  normal  and  failure  conditions. 

4.5  Confidence  Testing 

Confidence  testing  is  performed  to  generate  operating  experience  with  the  FCS  functioning  as  a  complete 
system.  It  is  performed  with  a  full  set  of  real  equipment  and  with  the  rig  operating  in  the  full  closed-loop 
mode.  A  series  of  representative  1  hour  sorties  are  flown  by  pilots  and  engineers  with  each  sortie  including 
power-up  BIT  checks,  takeoff,  a  formal  handling  test  sequence,  a  period  of  free  style  handling,  approach 
and  landing,  and  system  shutdown.  This  test  sequence  is  flown  as  often  as  is  considered  necessary  and  is 
intended  to  exercise  the  system  as  fully  as  possible  over  as  wide  a  range  of  conditions  as  possible.  For 
example,  prior  to  the  first  flight  of  a  new  aircraft  a  minimum  of  50  sorties  is  considered  necessary. 
Following  subsequent  software  upgrades,  a  lower  number  will  be  performed. 

4.6  Flight  Trials  Preparation 

The  rig  can  be  used  to  provide  the  facility  for  the  pilots  and  engineers  to  rehearse  each  test  flight  prior  to 
execution.  To  do  this,  it  can  be  used  either  in  full  simulation  mode  or  with  a  full  set  of  real  hardware 
depending  upon  the  state  of  the  flight  test  program  and  the  trials  being  performed.  For  example,  the  first 
flight  of  a  new  aircraft  will  be  rehearsed  with  a  full  set  of  real  equipment.  Subsequent  flights  may  be 
practiced  on  either  the  rig  or  on  the  flight  simulator  depending  upon  the  actual  flight  trial  involved.  For 
example,  the  simulator  outside  world  display  will  usually  be  of  much  higher  quality  than  that  on  the  FCS 
rig  and  so  the  flight  simulator  would  be  more  appropriate  for  handling  qualities  testing. 

The  rig  (and  simulator)  can  also  be  used  to  provide  a  realistic  training  facility  for  pilots  and  engineers  to 
practice  drills  and  procedures  for  all  possible  failure  scenarios.  Even  the  most  convoluted  and  potentially 
hazardous  failures  and  emergencies  can  be  practiced  in  complete  safety! 

5.0  AIRCRAFT  GROUND  TESTING 

Before  the  aircraft  is  ready  to  commence  the  flight  trials  programa  whole  series  of  ground  tests  are 
required.  These  comprise  FCS  build  tests,  ground  resonance  and  structural  coupling  tests,  aircraft  systems 
testing  and  electromagnetic  compatibility  testing 

5.1  FCS  Build  Tests 

The  flight  control  system  is  fitted  to  the  aircraft  and  fully  functioned  in  the  aircraft  environment  to  ensure 
that  the  complete  system  design  has  been  correctly  implemented  into  the  airframe.  The  build  tests  confirm 
that  all  the  individual  items  of  FCS  equipment  and  all  the  FCS  wiring  are  functioning  correctly.  The  FCS 
build  tests  are  integrated  with  the  other  system  build  tests  to  ensure  that  all  the  interfaces  are  correct.  Thus 
the  electrical,  hydraulic,  cooling,  avionics  and  other  systems  must  also  be  shown  to  be  functioning  correctly 
from  a  flight  control  system  point  of  view.  Within  the  FCS,  all  the  actuators,  sensors  and  pilot  controls 
must  be  correctly  rigged  and  harmonized  and  it  must  also  be  demonstrated  that  there  are  no  sign  reversals 
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in  any  of  the  control  paths.  These  build  tests  utilize  an  automated  ground  test  facility  known  as  the 
Automatic  Test  Equipment  (ATE),  which  contains  its  own  computer  and  interfaces  directly  with  the  FCS 
computer  hardware  via  suitably  protected  interfaces. 

5.2  Ground  Resonance  Tests 

As  already  indicated,  the  design  process  involves  the  establishment  of  a  series  of  models,  which  need  to  be 
validated  during  the  ground  and  flight  test  program. 

Ground  resonance  tests  are  performed  to  identify  the  various  structural  modes  of  the  aircraft  (e.g.,  wing, 
fuselage,  fin,  tailplane/canard,  flap/elevon/elevator,  and  rudder)  and  provide  the  first  set  of  data  used  to 
validate  the  theoretical  structural  model  of  the  aircraft.  For  these  tests,  the  aircraft  is  positioned  in  a  suitable 
test  facility  (i.e.,  it  may  be  suspended  in  a  test  frame  or  supported  on  airbags)  so  as  to  replicate  the  in-flight 
state.  Suitable  external  excitation  equipment  is  used  on  the  different  parts  of  the  airframe  and  a  large 
number  of  accelerometers  are  fitted  to  the  aircraft  to  measure  the  structural  responses  and  identify  the 
actual  structural  modes. 

The  validated  structural  model  is  then  combined  with  the  aerodynamic  and  FCS  models  to  predict  the 
structural  characteristics  in  flight. 

5.3  Structural  Coupling  Tests 

Structural  coupling  (or  aeroservoelasticity  as  it  is  also  known)  is  the  phenomenon  associated  with  the 
introduction  of  a  high-gain  flight  control  system  into  a  flexible  airframe.  The  FCS  sensors  (both  motion  and 
position)  will  detect  not  only  rigid-body  motions  (used  to  control  the  aircraft),  but  also  any  structural  mode 
oscillations  (generated  by  the  flexible  structure)  superimposed  on  these  signals.  If  the  attenuation  and 
phasing  of  the  structural  signals  are  inadequate,  then  instabilities  can  occur.  Such  an  instability  is 
potentially  catastrophic  because  it  can  result  in  either  loss  of  control  or  severe  structural/fatigue  damage  to 
the  aircraft. 

The  flight  control  system  is  designed  such  that  structural  mode  filtering  is  included  in  the  control  paths 
where  the  structural  model  of  the  aircraft  indicates  that  potential  instabilities  can  occur.  A  series  of 
structural  coupling  ground  tests  are  performed  to  identify  the  characteristics  of  relevant  structural  modes 
and  to  test  the  implemented  structural  notch  filers.  Suitable  test  equipment  is  used  to  drive  the  FCS 
actuators  over  the  required  range  of  frequencies  and  each  FCS  sensor  is  monitored  to  determine  the 
characteristics  of  any  structural  response.  The  tests  have  to  be  done  in  a  variety  of  aircraft  configurations 
(i.e.,  different  fuel  states,  a  selection  of  external  store  configurations  and  various  FCS  states)  in  order  to 
determine  the  full-filter  requirements.  The  data  are  used  to  update  the  aircraft  structural  and  FCS  models. 
Structural  notch  filters  are  then  designed  using  the  complete  aircraft  structural/aerodynamic/FCS  model. 

Further  on-aircraft  tests  are  then  performed  with  the  notch  filters  implemented  in  the  control  laws  in  order 
to  demonstrate  satisfactory  stability  margins  with  the  full-flight  standard  equipment.  For  all  these  tests,  the 
aircraft  has  to  be  in  as  close  to  the  flight  ready  condition  as  possible  so  that  the  test  results  are  fully 
representative. 

5.4  Electromagnetic  Compatibility  Testing 

Electromagnetic  interference  (EMI)  represents  a  serious  problem  for  an  electronic  FCS  since  it  provides  a 
mechanism  for  potential  common  mode  failures  in  a  multiredundant  FCS.  Malfunctions  caused  by  EMI  can 
range  between  being  insignificant  in  nature  to  causing  catastrophic  failures.  The  EMI  can  be  both  internally 
and  externally  sourced  and  the  FCS  design  process  must  address  these  issues.  The  flight  control  computers, 
control  surface  actuators,  sensors  units  (inertial  and  air  data)  as  well  as  all  pilot  inceptors,  switches,  and  all 
data  bus  inputs  and  wiring  associated  with  the  FCS  must  be  designed  to  be  resistant  to  all  forms  of 
electromagnetic  interference.  This  will  include  radio  frequency  (RF),  microwave,  lightning  and 
electromagnetic  pulse  (EMP)  sourced  interference. 
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Before  the  aircraft  is  flown  for  the  first  time,  sufficient  electromagnetic  compatibility  (EMC)  testing  is 
performed  on  the  complete  aircraft  to  ensure  that  the  aircraft  is  safe  to  fly  in  the  local  electromagnetic 
environment.  As  the  test  program  continues,  EMC  testing  to  clear  the  aircraft  to  the  full  electromagnetic 
threat  levels  is  performed. 

Initial  on-aircraft  testing  will  commence  with  the  aircraft  in  an  unpowered  condition  and  either  single  loom 
or  multiloom  bulk  current  injection  tests  may  be  performed.  An  external  antenna  can  also  be  used  to  radiate 
the  aircraft  at  a  number  of  different  aircraft  orientations  and  over  a  range  of  frequencies  and  transmitter 
characteristics  (e.g.,  horizontally  and  vertically  polarized).  Measurements  are  taken  at  the  FCS  equipment 
to  determine  the  level  of  current  induced  per  unit  of  field  strength.  These  results  can  then  be  compared  with 
the  results  of  equipment  bench  test  results  done  at  much  higher  test  levels.  Testing  will  then  progress  to  the 
powered  aircraft  configuration  and  a  range  of  tests  will  be  performed.  Typical  tests  are  system  interaction 
tests,  onboard  transmitter  tests,  and  external  transmitter  tests. 

System  interaction  tests  are  performed  to  ensure  that  all  aircraft  systems  are  mutually  compatible  with  each 
other,  and  in  particular  with  the  FCS.  Thus  all  modes  of  operation  of  each  aircraft  system  must  be  selected 
and  exercised  during  engine  running  tests  to  ensure  freedom  from  cross  system  interactions. 

Where  appropriate,  measurements  may  be  made  of  transients  produced  on  the  aircraft  electrical  bus  bars  as 
manually  or  automatically  switched  functions  are  operated.  All  onboard  transmitters  are  exercised  across 
their  frequency  range  at  normal  and,  where  possible,  at  enhanced  power  levels  to  ensure  freedom  from 
EMI. 

Testing  against  external  transmitters  can  also  be  performed  in  a  number  of  ways.  Traditionally,  the  aircraft 
under  test  has  been  exposed  to  each  type  of  external  transmitter  likely  to  be  encountered  during  its 
development  and  then  ultimately  its  service  life.  Current  test  techniques  utilize  a  test  site  with  antennas 
capable  of  exposing  the  live  aircraft  to  radiation  over  the  appropriate  range  of  frequencies. 

Monitoring  the  behavior  of  the  FCS  during  these  tests  can  be  done  in  variety  of  ways.  One  option  is  to  use 
the  instrumentation  system,  but  this  requires  careful  interpretation  since  the  FTI  system  on  an  aircraft  can 
itself  suffer  from  EMI.  (In  fact,  it  may  be  more  likely  to  suffer  from  EMI  because  it  is  not  necessarily 
designed  to  the  same  high  levels  of  EMC  hardness  as  the  actual  aircraft  systems.) 

A  better  option  is  to  use  fiber-optic  links  from  the  FCS  computers  to  a  remote  computer  monitoring  facility 
that  can  be  used  to  monitor  a  large  number  of  FCS  signals  against  thresholds  agreed  in  advance. 

The  generation  of  a  clearance  to  fly  in  conditions  of  a  high-lightning  risk  is  also  very  important  in  an 
aircraft  development  flight  program  and  is  essential  for  a  service  aircraft.  Such  a  clearance  requires  an  FCS 
that  can  survive  lightning  strikes.  When  digital  computers  were  first  used  in  flight  control  systems,  there 
was  concern  that  their  processors  could  be  corrupted  by  the  electrical  pulses  generated  by  lightning  strikes. 
System  hardware  and  cable-loom  screening  design  processes  have  been  developed  to  protect  such 
equipment  from  lightning  strike  effects  and  these  are  particularly  important  on  an  aircraft  with  composite 
structures.  Although  equipment  bench  tests  can  be  used  to  demonstrate  equipment  resistance  to  lightning 
strikes  and  EMP,  it  is  now  often  considered  necessary  to  perform  whole  aircraft  lightning  strike  tests  to 
validate  the  design  and  clearance  process.  Such  a  series  of  tests  requires  a  dedicated  test  facility  including  a 
test  frame  tailored  to  the  particular  type  of  aircraft  under  test.  Although  such  testing  is  usually  carried  out 
with  an  unpowered  aircraft,  there  are  occasions  where  some  testing  is  performed  with  a  live  FCS.  Whole 
aircraft  lightning  testing  was  carried  out  on  both  the  FBW  Jaguar  and  the  EAP  demonstrator. 

5.5  Engine  Running  Tests 

The  final  ground  tests  are  a  series  of  engine  runs  when  the  FCS  and  all  other  aircraft  systems  are  functioned 
with  the  aircraft  providing  its  own  internal  power.  (Hangar  checks  utilize  external  rigs  to  provide  electrical 
and  hydraulic  power  to  the  aircraft  systems.)  These  tests  represent  the  first  opportunity  to  function  the 
complete  aircraft  in  a  fully  representative  flight  condition.  For  the  FCS,  the  full  power-up  and  BIT 
functions  are  assessed  together  with  the  FCS  interaction  with  the  hydraulic,  electrical,  avionic,  and  engine 
systems. 
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6.0  FLIGHT  TEST  TOOLS  AND  TECHNIQUES 

In  order  to  assess  the  performance  and  behavior  of  an  aircraft,  an  extensive  instrumentation  system  is 
required.  Until  recently,  the  instrumentation  system  comprised  a  full  set  of  independent  sensors,  which 
recorded  the  state  of  the  aircraft  and  its  systems.  With  the  introduction  of  electronic  FCSs  and  digital 
busses,  most  of  the  data  required  by  the  instrumentation  can  be  recorded  directly  from  the  aircraft  systems. 
Some  additional  independent  sensors  are  still  required  such  as  accelerometers  for  flutter/vibration 
measurements,  strain  gauges  and  pressure  transducers  for  load  measurements,  and  other  specific  sensors 
such  as  temperature  transducers.  Telemetry  is  also  required  to  make  the  flight  test  program  both  safer  and 
more  efficient.  In  particular,  telemetry  makes  possible  the  in-flight  analysis  techniques  described  below. 

In  addition,  a  number  of  specific  flight  test  facilities  are  required  in  order  to  carry  out  the  flight  test 
program.  Such  facilities  will  usually  include  a  flight  test  noseboom  with  flow  direction  sensing  vanes  fitted 
and  some  form  of  flutter  mode  excitation  equipment.  The  noseboom  pressure  sensors  and  vanes  provide  an 
independent  measure  of  aircraft  flight  conditions  (e.g.,  airspeed,  altitude,  AOA  and  sideslip)  in  order  to 
facilitate  calibration  of  the  FCS  air  data  sensors.  The  flutter  mode  excitation  equipment  is  used  to  excite  the 
various  flutter  modes  of  the  aircraft  in  flight  in  order  to  demonstrate  adequate  levels  of  damping  and  hence 
validate  the  structural  model  of  the  aircraft.  Other  special  flight  test  facilities  are  fitted  for  specific  flight 
trials.  For  example,  when  high  AOA  trials  are  performed,  there  is  a  risk  of  departure  from  controlled  flight 
and  spin  entry.  Prior  to  the  start  of  these  trials,  emergency  recovery  devices  including  a  spin  recovery 
parachute  and  alternative  hydraulic  and  electrical  power  sources  are  fitted.  These  of  course  have  to  be 
tested  on  the  ground  and  in  the  air  before  the  start  of  the  trials. 

The  current  UK  flight  test  philosophy  of  fly  to  validate  the  model  requires  a  number  of  novel  test  facilities 
as  well  as  new  excitation  and  analysis  techniques.  These  were  developed  over  the  recent  flight  test 
programs  of  the  Tornado,  FBW  Jaguar  and  the  EAP  demonstrator  as  described  in  the  following  section. 

7.0  FLIGHT  TESTING 

The  flight  trials  assessment  of  an  advanced  digital  FCS  involves  a  wide  range  of  test  disciplines.  These 
include,  aerodynamic  stability  and  control,  aerodynamic  loading,  dynamic  characteristics  (flutter  and 
structural  interaction),  air-data  sensors,  hydraulic  and  electrical  systems  as  well  as  the  total  flight  control 
system.  Thus,  from  a  FCS  point  of  view,  the  objectives  and  sequence  of  the  flight  test  program  will  be 
dependent  upon  the  aircraft  to  be  evaluated.  The  two  flight  test  programs  described  illustrate  the  evolution 
of  the  flight  test  techniques  now  in  use  on  the  Eurofighter. 

7.1  FBW  Jaguar  Demonstrator  Flight  Test  Program 

Full  details  of  the  very  successful  FBW  Jaguar  Demonstrator  program  can  be  found  in  References  1  to  4. 
The  flight  trials  took  place  between  1981  and  1984  and  telemetry  was  used  throughout.  Although  the 
telemetry  system  was  limited,  it  enabled  efficient  sortie  management  as  well  as  providing  safety  monitoring 
and  engineering  backup  for  the  test  pilot.  Detailed  analysis  was  performed  between  flights  to  ensure 
satisfactory  behavior  of  the  FCS  and  to  further  validate  the  aerodynamic  models.  The  FBW  Jaguar 
commenced  the  flight-trials  phase  as  an  aircraft  that  was  aerodynamically  unchanged  from  a  standard 
Jaguar  and  so  the  aerodynamic  and  structural  models  did  not  require  validation.  However,  the  aircraft  was 
equipped  with  new  primary  control  surface  actuators;  the  control  laws  were  completely  new  and  the  air- 
data  sensors  were  also.  Thus  the  initial  objectives  of  the  flight  test  program  were  not  only  to  demonstrate 
the  basic  performance  and  integrity  of  the  FCS,  but  to  carry  out  an  assessment  of  the  aircraft  handling 
qualities,  calibrate  the  air-data  system  and  validate  the  impact  on  the  aircraft  flutter  characteristics  of  the 
new  actuation  system. 

Once  the  air-data  sensors  were  fully  calibrated,  the  control  laws  were  updated  to  use  the  validated  air-data 
signals  and  the  flight  test  program  moved  into  the  next  phase.  This  involved  a  full  handling  qualities 
assessment  including  high  AOA  testing  where  the  stall  departure  and  spin  prevention  function  of  the 
control  laws  were  fully  evaluated.  It  also  included  the  first  flight  trials  assessment  of  the  aircraft  in  a 
longitudinally  unstable  aerodynamic  configuration  (i.e.,  achieved  using  a  large  amount  of  lead  ballast  in  the 
rear  fuselage). 
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Up  to  this  point  in  the  program,  the  demonstrator  aircraft  had  been  a  standard  Jaguar  with  aerodynamic 
characteristics  that  were  well  established  both  from  wind  tunnel  and  flight  data.  However,  the  final  phases 
of  the  program  involved  the  fitting  of  large  wing  leading-edge  extensions  (strakes)  in  order  to  generate  high 
levels  of  longitudinal  instability.  Since  this  resulted  in  significant  changes  to  the  aerodynamic 
characteristics,  a  new  aerodynamic  model  was  generated  from  theoretical  and  wind-tunnel  data.  This  was 
used  in  the  control-law  design  and  flight  clearance  process,  but  required  in-flight  validation  before 
maximum  levels  of  instability  could  be  flown.  Since  the  demonstrator  aircraft  was  highly  augmented, 
conventional  control  inputs  did  not  provide  adequate  excitation  for  extraction  of  aerodynamic 
characteristics  (parameter  identification).  A  new  excitation  technique  was  therefore  assessed  on  the  FBW 
flight  simulator  and  validated  in  flight  on  the  FBW  demonstrator  aircraft  while  it  was  still  in  the  well 
defined  standard  Jaguar  aerodynamic  configuration.  This  technique  required  the  pilot  to  apply  a  3-2-1-1 
control  input,  which  would  provide  excitation  over  a  range  of  frequencies  and  so  enable  successful 
aerodynamic  parameter  identification.  The  name  3-2-1-1  was  derived  from  the  fact  that  the  duration  of  the 
pilot  inputs  was  defined  by  the  time  signature  3t  -  2t  - 1  - 1  seconds  as  illustrated  in  Figure  B2. 


Control  Input  Amplitude 


When  the  large-wing  leading-edge  strakes  were  fitted,  this  technique  was  used  to  validate  the  new 
aerodynamic  model  of  the  aircraft.  Initial  flight  trials  were  performed  in  a  configuration  with  low  levels  of 
aerodynamic  instability  where  the  control  laws  were  comparatively  insensitive  to  tolerances  in 
aerodynamic  derivatives.  Once  the  aerodynamic  model  had  been  shown  to  be  within  the  tolerances  used  in 
the  control-law  design  process,  flight  testing  progressed  rapidly  to  the  maximum  levels  of  instability. 

The  aircraft  was  successfully  flight  tested  to  high  levels  of  longitudinal  instability.  The  actual  highest  level 
of  aerodynamic  instability  flown  had  a  time  to  double  amplitude  of  250  msecs.  This  was  completely 
transparent  to  the  pilot  since  the  FCS  provided  a  very  stable  and  maneuverable  aircraft  with  excellent 
handling  qualities.  The  step-by-step  flight  test  program  was  fully  vindicated  and  gave  great  confidence  for 
subsequent  digital  FCS  equipped  aircraft  development  programs. 

8.0  THE  EAP  DEMONSTRATOR  FLIGHT  TEST  PROGRAM 

The  experimental  aircraft  program  (EAP)  evolved  from  a  number  of  European  studies  into  future  combat 
aircraft  requirements.  These  studies  identified  that  a  major  requirement  would  be  for  a  highly  maneuverable 
aircraft  for  close  and  medium  range  air  combat  with  a  secondary,  but  effective,  capability  for  air-to-surface 
battlefield  support.  This  in  turn  would  require  a  lightweight  single-crew  aircraft  capable  of  carrying  a  wide 
variety  of  stores  and  twin-engined  so  as  to  provide  a  high  level  of  survivability.  To  produce  this  within  an 
acceptable  cost  would  require  extensive  use  of  new  technologies,  many  of  which  were  either  still  at  the 
conceptual  stage,  or  in  the  early  stage  of  development.  In  1983,  British  Aerospace  and  the  United  Kingdom 
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government  signed  a  partnership  agreement  for  a  program  to  design  and  manufacture  a  demonstrator 
aircraft,  which  would  integrate  the  new  technologies.  This  EAP  included  an  extensive  flight  test 
development  phase  to  assess  and  prove  the  viability  of  the  new  technologies  as  a  complete  concept.  A  more 
detailed  description  of  the  program  and  its  objectives  can  be  found  in  References  5  and  6,  but  the  following 
details  are  of  particular  relevance  to  this  appendix. 

8.1  The  Demonstrator  Aircraft 

The  aircraft,  designed,  built  and  flown  during  the  program,  was  known  as  the  EAP  demonstrator.  The 
airframe  was  a  canard  delta  configuration  with  a  structure  containing  widespread  use  of  carbon-fiber 
composites  and  manufactured  using  an  advanced  co-bonding  technique.  The  cranked  delta  wing  with  full- 
span  trailing-edge  flaperons  and  leading-edge  droop,  together  with  large  authority  moving  canards 
(foreplanes)  and  a  single  fin  and  rudder  resulted  in  an  aerodynamic  configuration,  which  was  inherently 
very  unstable  (both  longitudinally  and  directionally)  and  nonlinear.  A  full  authority  quadruplex  digital  FCS 
was  designed  to  stabilize  the  airframe  and  to  provide  optimum  Level  1  handling  characteristics  which 
would  allow  the  pilot  unrestricted  use  of  controls,  (carefree  handling).  This  FCS  was  a  further  development 
of  the  FCS  developed  for  the  FBW  Jaguar  and  as  such  had  no  backup  electrical  or  mechanical  system. 
More  detailed  descriptions  of  both  the  FCS  and  of  the  digital  cockpit,  avionic  and  aircraft  systems  can  be 
found  in  References  5  and  7. 

The  initial  objectives  of  the  EAP  demonstrator  flight  test  program  could  be  summarized  as: 

a.  A  progressive  expansion  of  the  flight  envelope  to  establish  confidence  in  the  overall  design  of  the 
aircraft  and  its  systems. 

b.  A  progressive  assessment  of  the  maneuvering  capability  of  the  aircraft  provided  by  the  combination 
of  the  advanced  aerodynamic  and  structural  configuration  and  the  active  FCS. 

In  order  to  achieve  these  objectives,  a  test  to  confirm  satisfactory  flight  trials  philosophy  was  to  be  used, 
the  development  of  which  is  described  in  Reference  8.  This  philosophy  can  be  described  as  an  integrated 
flight  clearance  and  flight  assessment  process  whereby  the  aircraft  is  cleared  to  fly  over  the  full  flight 
envelope  provided  that  the  flight  measured  data  can  be  shown  to  validate  the  toleranced  aerodynamic 
models  used  in  the  clearance  process.  Such  a  philosophy  requires  analysis  tools  that  can  analyze  flight  data 
in  near  real  time  and  provide  the  ability  to  compare  the  results  with  equivalent  data  generated  from  both  the 
nominal  and  the  toleranced  aerodynamic  models.  In  this  way,  if  the  flight  data  can  be  shown  to  lie  within 
the  predetermined  model-generated  boundaries  of  acceptability,  the  flight  assessment  program  can  continue 
with  no  delays  for  postflight  analysis. 

8.1.1  Analysis  Techniques 

The  new  analysis  techniques  set  in  place  for  the  start  of  the  demonstrator  flight  trials  were  designed  to 
enable  validation  of  the  stability  and  control  and  loads  models  of  the  aircraft  in  quasi  real  time.  These 
techniques  are  described  in  References  8  and  9,  but  can  be  summarized  as  follows. 

8.1. 1.1  Z  Transform  Analysis 

This  technique  determined  the  frequency  or  real-root  position  for  longitudinal  and  lateral/directional  modes 
from  small  perturbation  maneuvers  such  as  3-2-1-1  inputs  or  doublets.  By  comparing  the  in-flight  results 
with  data  from  the  nominal  and  toleranced  aerodynamic  models,  the  aerodynamic  model  could  be  validated 
at  each  test  condition  within  2  minutes  of  the  test  input. 

8.1. 1.2  Comparison  of  Aircraft  Response  Data  with  Predictions 

This  technique  compared  the  aircraft  flight  response  data  from  large  perturbation  maneuvers  with  preflight 
prediction  data  for  the  nominal  aerodynamic  model  at  the  test  condition.  The  results  were  obtained 
immediately;  the  maneuver  was  performed  by  cross  plotting  specific  response  parameters  in  real  time  for 
comparison  with  the  pre -prepared  boundaries. 
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8.1. 1.3  Aerodynamic  Loads  Analysis 

Aircraft  loads  were  computed  from  telemetered  aircraft  response  data  using  the  loads  model  hosted  on  the 
mainframe  computer,  which  was  linked  to  the  telemetry  facility  computers  via  a  fiber-optic  link.  Computed 
loads  were  compared  with  maximum  allowable  loads  and  results  were  available  less  than  30  seconds  after 
completion  of  the  test  maneuver. 

8.1.2  Parameter  Identification. 

Although  this  could  not  be  accomplished  in  real  time,  the  transmission  of  telemetered  data  to  the 
mainframe  computer  made  it  possible  for  the  process  to  commence  as  soon  as  the  test  maneuver  was 
completed.  Thus  initial  results  could  be  available  by  the  end  of  the  test  flight  with  full  results  a  few  hours 
later.  However,  this  level  of  detailed  analysis  was  not  necessary  if  the  techniques  described  previously 
showed  that  the  aircraft  was  within  tolerance. 

8.1.3  Flight  Trials 

The  flight  trials  of  the  EAP  demonstrator  aircraft  commenced  in  August  1986  and  the  new  analysis 
techniques  enabled  a  rapid  expansion  of  the  flight  envelope  as  described  in  Reference  5.  In  less  than  3 
weeks,  20  flights  were  performed  validating  the  aerodynamic  models  to  the  extent  that  a  full  display 
sequence  was  cleared  for  the  aircraft  to  fly  at  the  Farnborough  air  show,  which  commenced  3  weeks  after 
first  flight. 

The  demonstrator  flight  trials  continued  until  May  1991  (Reference  6)  during  which  period  significant 
development  took  place  of  both  the  FCS  and  the  real-time  analysis  techniques.  Since  the  aircraft  and  FCS 
configuration  were  very  similar  to  that  proposed  for  the  Eurofighter,  the  EAP  flight  test  program  proved  to 
be  an  effective  risk  reduction  exercise  for  the  Eurofighter  development  program  as  described  in 
Reference  10. 

9.0  FCS  DEVELOPMENT  DURING  THE  FLIGHT  TEST  PROGRAM 

As  already  indicated,  the  EAP  demonstrator  FCS  was  a  quadruplex  digital  system  with  no  electrical  or 
mechanical  backup.  The  core  of  the  system  (e.g.,  rate  and  acceleration  sensors,  computing,  actuator 
interface,  pilot  inceptors,  and  switches)  was  quadruplex,  but  the  air-data  system,  which  was  integrated 
within  the  FCS  was  effectively  triplex.  Triplex  Pitot-static  data  was  provided  by  a  noseprobe  and  two 
foreplane  tip  mounted  probes  with  the  noseprobe  acting  as  the  primary  source.  Triplex  AOA  and  sideslip 
signals  were  derived  from  four  airstream  direction  detector  probes  mounted  around  the  lower  surface  of  the 
nose.  A  double  failure  of  the  AOA/sideslip  sensors  would  put  the  FCS  into  its  reversionary  mode.  Loss  of 
any  two  of  the  three  Pitot-static  probes  would  put  the  FCS  into  its  fixed  gains  mode.  The  aircraft  could  be 
recovered  from  any  part  of  the  envelope  following  failure  into  the  reversionary  mode.  However,  the  level 
of  instability  of  the  basic  airframe  was  such  that  there  were  parts  of  the  envelope  where  it  could  not  be 
recovered  in  the  event  of  a  failure  into  the  fixed  gains  mode.  For  a  demonstrator  aircraft,  this  was  deemed 
to  be  an  acceptable  situation  since  the  fixed  gains  mode  had  been  originally  conceived  as  a  safe  ejection 
platform  only.  This  was  because  the  air-data  system  was  designed  to  be  sufficiently  robust  as  to  make  the 
likelihood  of  a  reversion  to  fixed  gains  very  remote.  However,  recovery  procedures  were  developed  on  the 
ground-test  rig  with  the  pilots  such  that  an  optimum  recovery  profile  was  devised  to  ensure  safe  recovery 
following  an  air-data  system  failure.  In  the  event,  the  design  assumption  was  fully  justified  since  there  were 
no  failures  of  the  Pito-static  system  throughout  the  flight  trials  program. 

The  initial  flight  trials  of  the  aircraft  were  performed  with  the  FCS  in  its  reversionary  mode;  the  AOA  and 
sideslip  sensors  were  not  used  by  the  control  laws  but  were  fully  active  so  that  the  wind-tunnel  derived 
calibration  could  be  validated  in  flight.  In  addition,  the  aircraft  was  ballasted  to  a  forward  eg  position  to 
reduce  the  level  of  instability.  (Even  in  this  configuration  the  level  of  longitudinal  instability  was  such  that 
the  time  to  double  amplitude  was  of  the  order  of  250  msec,  similar  to  the  most  unstable  condition  flown  on 
the  FBW  Jaguar.)  Once  the  air-data  sensors  had  been  calibrated  over  the  initial  flight  envelope  (Reference 
10),  the  full  system  control  laws  were  programmed  into  the  FCS,  the  forward  ballast  moved,  and  the  first 
phase  of  the  carefree  handling  flight  trials  performed.  Again,  using  the  real-time  analysis  and  model- 
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validation  techniques  described  previously,  the  initial  carefree  envelope  was  successfully  cleared  in  25 
flights  over  a  period  of  4  weeks.  Such  a  high  risk  flight  trial  meant  that  the  aircraft  was  equipped  with  a 
spin-recovery  parachute  and  appropriate  emergency  power  supplies,  as  well  as  a  spin  recovery  mode  within 
the  FCS.  These  facilities  were  never  used  in  anger  throughout  the  demonstrator  program  and  this  was  due 
primarily  to  the  success  of  the  model  validation  techniques  developed  and  used  in  the  flight  trials. 

The  last  phase  of  the  FCS  development  was  the  implementation  of  the  final  standard  of  control  laws,  which 
enhanced  the  subsonic  carefree  handling  characteristics  and  introduced  supersonic  carefree  handling.  This 
was  achieved  by  utilizing  a  blend  of  AOA  and  normal  acceleration  limiting  together  with  the  introduction 
of  inertially  derived  AOA  and  sideslip  signals  as  well  as,  attitude  scheduling  functions  within  the  control 
laws.  The  development  of  the  control  laws  is  described  in  Reference  1 1  and  the  carefree  handling  flight 
trials  in  Reference  12.  Pilot  comment  was  extremely  favorable  (Reference  12)  with  quotes  such  as,  “the 
aircraft  and  FCS  withstanding  the  most  savage  abuse.”  The  real-time  analysis  tools  again  enabled  rapid  and 
successful  assessment  over  the  full  flight  envelope. 

10.0  FLIGHT  TEST  AND  ANALYSIS  TECHNIQUE  DEVELOPMENT 

During  the  flight  trials  phase  of  the  EAP  demonstrator,  a  number  of  significant  developments  took  place 
both  in  the  provision  of  test  facilities  and  in  the  use  of  real  time  model  validation  techniques.  Of  these,  the 
provision  of  an  in-flight  structural  mode  excitation  system  within  the  FCS  and  the  use  of  a  real-time  air- 
data  system  model  validation  analysis  technique  are  of  particular  interest  and  are  described  in  the  following 
section.  Other  developments  included  the  provision  of  a  synthetic  target  tracking  system  (designed  to 
demonstrate  good  handling  characteristics  and  freedom  from  pilot-in-the-loop  oscillations  in  high-gain 
tasks)  and  the  development  of  an  in-flight  pressure  plotting  technique,  to  validate  the  aerodynamic  loads 
model.  More  details  of  these  can  be  found  in  References  10  and  13. 

10.1  In-Flight  Structural  Mode  Excitation 

A  facility  to  excite  the  aircraft  structural  modes  via  the  aircraft  control  surface  actuators  were  developed  on 
the  FCS  ground-test  rig  and  implemented  into  the  Flight  Control  Computers  FCCs  (as  described  in 
Reference  14).  This  was  achieved  by  generating  quadruplex  frequency  sweep  and  impulse  excitation 
signals  within  the  computers  and  injecting  them  directly  into  the  primary  actuator  control  loops  on  to  the 
foreplane  and  flaperon  surfaces.  Up  to  63-pilot  selectable  test  cases  were  programmed  in  to  give  a  choice  of 
surface,  amplitude,  symmetric  or  antisymmetric  excitation  and  frequency  sweep/impulse  profile.  The 
facility  was  tested  over  a  period  of  15  flights  and  shown  to  be  very  effective  (Reference  14).  In  particular,  it 
offered  great  potential  to  reduce  overall  test  time  when  compared  with  conventional  flutter  mode  excitation 
techniques  since  it  enabled  a  large  number  of  test  points  to  be  performed  per  test  flight.  (In  fact,  83  test 
points  were  flown  on  one  flight  using  this  system.)  In  addition,  it  provided  flight  data  that  was  subsequently 
used  in  the  development  of  quasi  real-time  analysis  techniques  for  use  on  the  Eurofighter  flutter  flight  test 
program  (Reference  15). 

The  same  FCS  test  facility  was  used  to  develop  new  test  and  analysis  techniques  that  could  measure  both  on¬ 
ground  and  in-flight  structural  coupling  characteristics.  These  techniques  would  enable  accurate  dynamic 
structural  models  to  be  generated  and  subsequently  verified  in  flight  in  order  to  determine  optimum  notch- 
filter  requirements  within  the  FCS.  The  aim  was  to  demonstrate  that  a  number  of  store  configurations  could  be 
cleared  into  flight  with  a  common  notch  filter  design.  This  was  successfully  achieved  as  described  in 
Reference  16  and  the  methodology  and  in-flight  test  philosophy  developed  were  fed  directly  into  the 
Eurofighter  program. 

10.2  Real  Time  Air  Data  Model  Validation 

The  level  of  instability  of  the  EAP  demonstrator  configuration  resulted  in  high  gains  within  the  FCS  control 
laws  that  were  a  function  of  flight  condition.  If  airspeed  errors  were  excessive,  then  FCS  stability  would  be 
significantly  reduced,  particularly  in  transonic  and  supersonic  flight.  Although  the  noseprobe  air-data 
correction  coefficients  were  comparatively  small  and  predictable,  the  correction  coefficients  for  the 
foreplane  tip  mounted  probes  were  both  more  complex  and  more  difficult  to  predict,  since  they  were  a 
function  of  foreplane  incidence  as  well  as  flight  condition.  During  the  supersonic  envelope  expansion  phase 
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of  the  flight  trials,  the  actual  difference  between  the  noseprobe  and  foreplane-tip  probe  sourced  air  data  was 
compared  in  real  time  with  predicted  differences  generated  in  advance  from  the  air-data  model.  Boundaries 
of  acceptability  were  superimposed  on  the  predictions  that  respected  minimum  FCS  stability  requirements. 
This  proved  to  be  very  successful  in  that  it  identified  errors  in  the  foreplane  tip  correction  coefficients,  but 
confirmed  in  real  time  that  the  errors  were  acceptably  small  and  so  expansion  could  continue.  Similar 
techniques  were  used  later  in  the  program  when  maneuvering  to  high  AOA.  The  techniques  developed,  fed 
directly  into  the  Eurofighter  flight  test  program. 

11.0  CONCLUSION 

The  ground  and  flight  test  development  of  modem  combat  aircraft  equipped  with  complex  digital  flight  control 
requires  a  test  philosophy,  which  will  be  both  safe  and  efficient  in  order  to  constrain  the  ever  increasing  costs  of 
such  programs.  Within  the  UK,  British  Aerospace  experience  on  the  FBW  Jaguar  and  EAP  demonstrator 
programs  has  demonstrated  that  the  concept  of  an  integrated  ground-  the  combination  of  real-time  analysis  and 
new  test  techniques  and  facilities  have  been  shown  to  be  effective  in  confirming  the  validity  of  the  aircraft  and 
systems  models  used  in  the  design  and  flight  clearance  process.  The  techniques  enable  a  more  efficient  and  hence 
cost-effective  development  flight  test  program  as  is  currently  being  demonstrated  by  the  progress  of  the 
Eurofighter  flight  trials  (References  17  through  22). 
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